Vibe Coding
CVE-2026-94031: nexus-mcp pipes a URL argument straight into child_process.exec
Published 2026-09-20, CVE-2026-94031 affects 0-Gaurav-0 nexus-mcp at commit aed0026, where the `nexus_reauth` MCP tool passes its `url` argument into `child_process.exec` in src/auth/browser.ts, giving remote command injection. NVD notes the exploit is public and the project uses no versioning, so there is no fixed release to pin to. This is the same shape as CVE-2026-93965 in SxDevOps that I reported on 2026-09-20 — an MCP tool that shells out to open a browser or start a server and treats a model-supplied string as a command.
Source
↳ Follow the thread