Threats tagged 'ghsa-9jww-cxg5-rj9m'

CVE-2026-84318 is a vulnerability in 0xJacky's nginx-ui where the MCP tool 'nginx_config_add' writes nginx configuration files without validating them, unlike the REST API which blocks dangerous directives. This allows an authenticated attacker to bypass security checks and write config files with blocked directives such as 'perl' or 'user root', leading to remote code execution on servers with certain nginx modules loaded. The vulnerability affects versions from 2.0.0-rc.6 up to but not including 2.4.1.