Executive brief
nexus-mcp is a multi-AI gateway server that uses Model Context Protocol. A command injection vulnerability in its browser reauthentication component allows attackers to execute arbitrary operating system commands by manipulating a URL parameter. An attacker with access to the MCP interface can achieve complete system compromise with the privileges of the nexus-mcp process.
Technical details
The nexus_reauth MCP tool in src/auth/browser.ts passes user-controlled URL arguments directly into a shell command executed via child_process.exec without sanitization, allowing OS command injection via shell metacharacters. The vulnerable code constructs platform-specific commands (e.g., `start "" "${loginUrl}"` on Windows) and executes them with shell interpretation enabled. An attacker with local or network access to the MCP interface can inject arbitrary commands by breaking out of quotes in the URL parameter.
Affected products
- 0-Gaurav-0 nexus-mcp all versions before commit aed0026e7ac1f23dc940e46e9fd3a2da6904f914
Timeline
- 2026-08-25: disclosed: Command injection vulnerability reported via GitHub issue
- 2026-09-20: advisory: CVE-2026-94031 published