CVE-2026-63496

Name of the Vulnerable Software and Affected Versions augment-vir versions prior to 31.73.5

Description The grep() function exported by @augment-vir/node inserts caller-controlled search patterns into a double-quoted shell command string without sanitization. When this command is passed to the spawn() function with the shell set to 'bash', the shell evaluates command substitution expressions embedded in the pattern. This allows for arbitrary OS command execution with the privileges of the Node.js process user. Applications passing untrusted input to the pattern or patterns fields of the grep() function are susceptible to unauthenticated local or remote code execution.

Recommendations Update to version 31.73.5. As a temporary mitigation, avoid passing untrusted input to the pattern or patterns fields of the grep() function.