CVE-2026-94031

Name of the Vulnerable Software and Affected Versions 0-Gaurav-0 nexus-mcp (affected versions not specified)

Description Command injection is possible in the nexus reauth MCP tool within the file src/auth/browser.ts. The issue occurs when the url argument is passed to the child process.exec() function, allowing a remote attacker to execute arbitrary commands.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict the use of the child process.exec() function in the src/auth/browser.ts file to minimize the risk of exploitation.