The vulnerability is caused by the MCP tool nginx_config_add bypassing the internal validation that normally blocks dangerous directives such as js_, perl_, load_module, and setting the user to root. Because the tool writes the supplied configuration directly to disk and reloads nginx, an authenticated caller can inject these directives and trigger arbitrary code execution in any environment where the njs or perl modules are enabled. This is a classic input validation failure combined with incorrect access control.

The flaw affects the 0xJacky nginx-ui application before version 2.4.1. Deployments that use the official Docker image, which includes the njs and perl modules, are at risk if the MCP tool is exposed to authenticated users or agents that can be induced via prompt injection.

With a CVSS score of 8.8 and no EPSS data available, the severity remains high. The vulnerability can be exploited as long as an attacker can obtain authentication or induce an MCP agent, after which the vulnerable add command can be executed. Because the attack path requires only authenticated access, the risk is significant in environments that expose the MCP interface. The lack of a KEV listing does not mitigate the potential for exploitation, and the flaw should be mitigated as quickly as possible.