Threats affecting pkg:github/0-gaurav-0/nexus-mcp

CVE-2026-94031 is a command injection vulnerability in the 0-Gaurav-0 nexus-mcp tool. It affects the child_process.exec function in the src/auth/browser.ts file of the nexus_reauth MCP component. The vulnerability arises from manipulation of the url argument, allowing remote attackers to execute arbitrary commands. The product uses a rolling release system, so specific affected or fixed versions are not disclosed. The vulnerability has a medium severity score of 5.3 and public exploit code is available. The vendor has not yet responded or provided a patch.