Threats tagged 'ghsa-5r62-gj48-897x'

CVE-2026-84319 is a vulnerability in 0xJacky's nginx-ui that allows a secondary authenticated user to bypass restricted directive validation in the MCP configuration interface. While the HTTP API blocks restricted Nginx directives such as load_module, js_import, and js_content, the MCP interface permits writing and applying equivalent restricted configurations. This enables execution of attacker-controlled NJS scripts within the Nginx worker context, potentially modifying runtime behavior including responses and routing. The vulnerability affects versions prior to 2.4.1. The CVSS score is 8.3 (high severity).