Vulnerability Description
@pensar/apex <= 0.0.58 is vulnerable to OS command injection via the smart_enumerate tool. The createSmartEnumerateTool() function in src/core/agent/tools.ts constructs a shell command by concatenating unsanitized values from the extensions array and url parameter into a string passed to Node.js child_process.exec(). Because exec() spawns a shell, shell metacharacters in those values are interpreted by the host shell, resulting in arbitrary OS command execution with the privileges of the running process. NOTE: this is disputed by the Supplier because the report is about intended behavior, as explained in the Security Policy of the pensarai/apex GitHub repo.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://gist.github.com/NucleiAv/47e87da08b90ef464fd9b35affe578fb
- https://github.com/pensarai/apex/security
- https://www.npmjs.com/package/@pensar/apex
FAQ
What is CVE-2026-36044?
CVE-2026-36044 is a vulnerability with a CVSS score of 8.8 (HIGH). @pensar/apex <= 0.0.58 is vulnerable to OS command injection via the smart_enumerate tool. The createSmartEnumerateTool() function in src/core/agent/tools.ts constructs a shell command by concatenatin...
How severe is CVE-2026-36044?
CVE-2026-36044 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-36044?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.