Threats tagged 'ghsa-76pm-mq2q-9gcr'

CVE-2026-84317 is an improper input validation vulnerability in the 0xJacky nginx-ui product. The vulnerability arises because the MCP tool 'nginx_config_add' does not enforce validation on user-supplied nginx configuration content, unlike other config-write paths. This allows an authenticated user to inject dangerous nginx directives such as 'js_*', 'perl_*', 'load_module', and 'user root', potentially leading to nginx code execution with root privileges if the njs/perl modules are available. The issue is due to an incomplete hardening patch that missed adding validation to the 'nginx_config_add' path. A proof of concept demonstrates remote code execution via JavaScript in the nginx worker running as root. The vulnerability affects versions prior to 2.4.1 and has a CVSS 3.1 score of 8.8 (high severity).