The vulnerability allows an attacker to send a crafted cross‑site GET request that triggers previously stored cron commands on Nezha Monitoring agents. By executing these commands, the attacker can run arbitrary code with the privileges of the agent process, potentially compromising the confidentiality, integrity, and availability of the monitored host. The weakness is a Cross‑Site Request Forgery flaw identified as CWE‑352.

Nezha HQ’s Nezha Monitoring product is impacted. All releases from version 1.0.0 up to, but not including, 2.0.14 are vulnerable. Upgrading to version 2.0.14 or later removes the flaw.

The CVSS score of 7.1 rates the flaw as a medium severity issue. The EPSS score of less than 1% indicates a low likelihood of exploitation at present, and the flaw is not listed in the CISA KEV catalog. Exploitation requires delivery of a cross‑site GET request to the agent endpoint, which may be possible if the agent is reachable from untrusted networks or if the attacker can embed the request in a trusted web context. If reached, the attacker can achieve remote command execution on the agent.