CVE-2026-94031
Received Received - Intake

Command Injection in Nexus MCP Tool

Publication date: 2026-09-20

Last updated on: 2026-09-20

Assigner: VulDB

Description
A vulnerability was detected in 0-Gaurav-0 nexus-mcp aed0026e7ac1f23dc940e46e9fd3a2da6904f914. Affected by this issue is the function child_process.exec of the file src/auth/browser.ts of the component nexus_reauth MCP tool. The manipulation of the argument url results in command injection. The attack may be performed from remote. The exploit is now public and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-20
Last Modified
2026-09-20
Generated
2026-09-20
AI Q&A
2026-09-20
EPSS Evaluated
N/A
NVD
CVE-2026-94031
EUVD
EUVD-2026-83747

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
0-gaurav-0 nexus-mcp to aed0026e7ac1f23dc940e46e9fd3a2da6904f914 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a command injection vulnerability in the nexus-mcp tool. The issue occurs in the nexus_reauth MCP tool where a user-controlled 'url' argument is embedded directly into a shell command executed via child_process.exec. Attackers can inject malicious commands by manipulating the URL parameter, allowing arbitrary OS command execution with the privileges of the nexus-mcp process.

Detection Guidance

Check if nexus-mcp is running and inspect the process for suspicious command execution patterns. Look for child_process.exec calls in src/auth/browser.ts. Use network monitoring to detect unexpected outbound connections from the nexus-mcp process.

Impact Analysis

This vulnerability allows attackers with access to the MCP interface to execute arbitrary OS commands. This could lead to data disclosure, modification, or complete system compromise. Attackers could steal sensitive data, install malware, or take control of the affected system.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection requirements and HIPAA's security rules. It may result in data breaches, unauthorized disclosures, or loss of protected health information, potentially leading to legal penalties and compliance violations.

Mitigation Strategies

Stop using nexus-mcp until a patch is released. If you must continue, restrict access to the MCP interface to trusted users only. Monitor system logs for signs of exploitation. Consider implementing network-level controls to block unauthorized command execution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94031. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart