CVE-2026-36044 Details
Description
@pensar/apex <= 0.0.58 is vulnerable to OS command injection via the smart_enumerate tool. The createSmartEnumerateTool() function in src/core/agent/tools.ts constructs a shell command by concatenating unsanitized values from the extensions array and url parameter into a string passed to Node.js child_process.exec(). Because exec() spawns a shell, shell metacharacters in those values are interpreted by the host shell, resulting in arbitrary OS command execution with the privileges of the running process. NOTE: this is disputed by the Supplier because the report is about intended behavior, as explained in the Security Policy of the pensarai/apex GitHub repo.
A command injection vulnerability has been identified in the '@pensar/apex' package, versions through 0.0.58. The issue arises in the 'smart_enumerate' tool, where the 'createSmartEnumerateTool()' function constructs a shell command by concatenating unsanitized values from the 'extensions' array and 'url' parameter. This command is then executed using Node.js's 'child_process.exec()', which spawns a shell and allows for arbitrary command execution with the privileges of the running process.
The recommended remediation is to replace 'child_process.exec()' with 'child_process.execFile()' and to validate 'extensions' entries with an allowlist. However, the vendor has declined to patch this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 27, 2026CISA-ADP
Assessed May 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/NucleiAv/47e87da08b90ef464fd9b35affe578fb | [email protected] | AdvisoryExploitTechnical Analysis |
| https://github.com/pensarai/apex/security | [email protected] | |
| https://www.npmjs.com/package/@pensar/apex | [email protected] | Permission RequiredVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Pensar Apex | <= 0.0.58 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 3, 2026 | CVE Modified | [email protected] |
| May 29, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | New CVE Received | [email protected] |