@pensar/apex versions 0.0.58 and earlier contain a command injection flaw in the smart_enumerate tool. The createSmartEnumerateTool() function builds a shell command by concatenating unsanitized values from an extensions array and a url parameter, then passes the string to Node.js child_process.exec(). Because exec() spawns a shell, any shell metacharacters in those values are interpreted, allowing an attacker to execute arbitrary commands with the privileges of the running process.

The vulnerability affects the @pensar/apex package for all releases up to and including v0.0.58. Any installation that uses this package and the smart_enumerate tool is potentially exposed; no other vendors or products are listed.

The CVSS score is 8.8, indicating high severity. EPSS score is 2%, indicating a low probability of exploitation, and the issue is not listed in CISA's KEV catalog. The exploit requires control over the extensions array or url parameter used by the tool. If the tool is exposed to an attacker—whether through a local user, a compromised process, or a remote request—an attacker can inject shell metacharacters to run arbitrary OS commands. The exact attack vector is not explicitly described in the advisory, but the function’s use of exec() implies that any user supplied input can be leveraged if the tool is reachable.