Nginx UI prior to version 2.4.1 splits configuration files on newline characters and only validates the first directive token on each line. Because Nginx allows multiple semicolon‑separated directives on a single line, an authenticated user can place a harmless directive first and append a restricted directive such as load_module, js_import, perl, or user root on the same line. This bypasses the intended deny‑list validation on REST API endpoints that modify configuration, allowing the attacker to inject executable directives. When an executable module is available, the injected configuration causes code to run in the Nginx worker context, resulting in remote code execution.

The vulnerability affects deployments of the 0xJacky Nginx UI project running any version earlier than 2.4.1, including the official Docker image. All REST API paths that modify configuration (nginx_config_modify, site, stream write) are susceptible, so any instance exposing these endpoints to authenticated users is at risk.

The CVSS score of 8.8 indicates high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires authenticated access to the REST API or configuration endpoints; once authenticated, an attacker can inject malicious directives via semicolon separation and achieve full code execution on the host, particularly if executable modules are present. The overall risk is substantial for systems that expose these endpoints or maintain privileged accounts.