CVE-2026-94031: nexus-mcp Command Injection RCE Vulnerability

CVE-2026-94031 Overview

CVE-2026-94031 is a command injection vulnerability in the 0-Gaurav-0 nexus-mcp project, identified at commit aed0026e7ac1f23dc940e46e9fd3a2da6904f914. The flaw resides in the child_process.exec call within src/auth/browser.ts, part of the nexus_reauth MCP tool. An attacker can manipulate the url argument to inject arbitrary operating system commands. The issue is classified under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component. The exploit is publicly disclosed, and the project maintainers have not responded to the issue report at the time of publication.

Critical Impact
Remote authenticated attackers can execute arbitrary operating system commands through unsanitized input passed to child_process.exec, resulting in limited confidentiality, integrity, and availability impact on the host running the MCP tool.

Affected Products

0-Gaurav-0 nexus-mcp at commit aed0026e7ac1f23dc940e46e9fd3a2da6904f914
Component: nexus_reauth MCP tool
File: src/auth/browser.ts

Discovery Timeline

2026-09-20 - CVE-2026-94031 published to NVD
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-94031

Vulnerability Analysis

The vulnerability exists in the authentication flow of the nexus-mcp Model Context Protocol (MCP) tool. Specifically, the nexus_reauth tool invokes child_process.exec inside src/auth/browser.ts to launch a browser session for reauthentication. The url parameter is concatenated into the shell command without neutralization of shell metacharacters. Because child_process.exec spawns a shell (/bin/sh on Unix or cmd.exe on Windows), any characters such as ;, &&, |, or backticks embedded in the url argument are interpreted as shell syntax. The result is arbitrary command execution in the context of the process running the MCP server.

The project follows a rolling release model, so no fixed version number is available. According to the reporter, the maintainers have not responded to the issue.

Root Cause

The root cause is unsafe use of child_process.exec combined with string concatenation of untrusted input. Node.js documentation explicitly warns against passing user-controlled values to exec because the underlying shell interprets metacharacters. Safer alternatives such as child_process.execFile or child_process.spawn with an argument array avoid shell interpretation entirely.

Attack Vector

Exploitation requires network access to the MCP tool and low-privilege authentication. An attacker who can invoke the nexus_reauth tool supplies a crafted url value containing shell metacharacters. When browser.ts builds and executes the shell command, the injected payload executes with the privileges of the MCP process. Since MCP tools are typically consumed by AI agents that pass parameters from prompt context, prompt-injection scenarios could also reach this sink indirectly.

No verified proof-of-concept code has been reproduced here. See the GitHub Repository for Nexus MCP and the GitHub Issue #1 for Nexus MCP for technical references, along with VulDB CVE-2026-94031 Details.

Detection Methods for CVE-2026-94031

Indicators of Compromise

Unexpected child processes spawned by the Node.js process hosting nexus-mcp, particularly shells (/bin/sh, bash, cmd.exe) launched with unusual command lines.
Outbound network connections initiated by shells rather than the Node.js runtime itself.
Log entries in the MCP tool showing url arguments containing shell metacharacters such as ;, |, &&, backticks, or $(...).

Detection Strategies

Perform static analysis of src/auth/browser.ts for child_process.exec calls that concatenate external input.
Monitor process ancestry to identify shell processes descended from the Node.js MCP server.
Correlate MCP request logs with process creation telemetry to flag suspicious nexus_reauth invocations.

Monitoring Recommendations

Enable command-line auditing (auditd on Linux, Sysmon Event ID 1 on Windows) for the account running the MCP server.
Alert on any invocation of shell interpreters as a child of the Node.js runtime hosting MCP tools.
Retain and review MCP tool invocation logs for prolonged periods to support retrospective hunts.

How to Mitigate CVE-2026-94031

Immediate Actions Required

Disable or remove the nexus_reauth MCP tool until a patched commit is available.
Restrict network access to the MCP server so only trusted clients can invoke tools.
Run the MCP process as a low-privilege, sandboxed user account to limit blast radius.

Patch Information

No vendor patch is available. The maintainers of 0-Gaurav-0/nexus-mcp have not responded to the GitHub Issue #1 for Nexus MCP at the time of publication. Because the project uses a rolling release model, monitor the GitHub Repository for Nexus MCP for a fix commit that replaces child_process.exec with child_process.execFile or spawn using argument arrays, along with strict URL validation.

Workarounds

Fork the repository and replace child_process.exec(cmd) with child_process.execFile(binary, [urlArg]) to avoid shell interpretation.
Validate the url argument against a strict allowlist (for example, https:// scheme with hostname allowlist) before passing it to any child process.
Deploy the MCP server inside a container with read-only filesystem, no shell binaries, and egress restrictions.

bash

# Configuration example: run nexus-mcp under a restricted systemd unit
# /etc/systemd/system/nexus-mcp.service
[Service]
User=nexus-mcp
Group=nexus-mcp
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
RestrictSUIDSGID=true
SystemCallFilter=@system-service
SystemCallFilter=~@debug @mount @swap @reboot @raw-io
CapabilityBoundingSet=
ExecStart=/usr/bin/node /opt/nexus-mcp/dist/server.js