CVE-2026-94031: 0-Gaurav-0 nexus-mcp nexus_reauth MCP tool browser.ts child_process.exec command injection
A vulnerability was detected in 0-Gaurav-0 nexus-mcp aed0026e7ac1f23dc940e46e9fd3a2da6904f914. Affected by this issue is the function childprocess.exec of the file src/auth/browser.ts of the component nexusreauth MCP tool. The manipulation of the argument url results in command injection. The attack may be performed from remote. The exploit is now public and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Mitigate the reported remote command-injection risk in src/auth/browser.ts (function child_process.exec of the nexus_reauth MCP tool) by blocking/restricting remote access to the vulnerable MCP tool endpoint until a code fix is applied.
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attack can be performed remotely, but the severity vector indicates low privileges are required. Exploitation does not require user interaction and has low attack complexity.
Which component should be prioritized for investigation?
Investigation should focus on the nexus_reauth MCP tool, specifically src/auth/browser.ts. The vulnerable behavior involves passing a manipulated url argument to child_process.exec.
Is public exploit material available?
Yes. The available data states that an exploit is public and may be used.
How can I determine whether my deployment is affected?
Check whether your nexus-mcp deployment includes the nexus_reauth MCP tool and the src/auth/browser.ts code path that invokes child_process.exec with a url argument. Exact affected and fixed version ranges are not disclosed because the project uses rolling releases.
Is a vendor fix or response available?
The project was reportedly notified through an issue report but had not responded at the time of publication. No updated release information is provided.