Filtered by vendor Pensar Subscriptions
Filtered by product Apex Subscriptions
Total 1 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-36044 1 Pensar 1 Apex 2026-05-31 8.8 High
@pensar/apex <= 0.0.58 is vulnerable to OS command injection via the smart_enumerate tool. The createSmartEnumerateTool() function in src/core/agent/tools.ts constructs a shell command by concatenating unsanitized values from the extensions array and url parameter into a string passed to Node.js child_process.exec(). Because exec() spawns a shell, shell metacharacters in those values are interpreted by the host shell, resulting in arbitrary OS command execution with the privileges of the running process.