The vulnerability in Nginx UI allows a secondary authenticated user to bypass the web interface’s restriction of critical Nginx directives such as load_module, js_import, and js_content. By writing and applying configuration through the MCP interface, the attacker can load the ngx_http_js_module.so module, inject custom JavaScript, reload Nginx, and execute the JavaScript in the worker context. This capability effectively grants the attacker remote code execution on the server, enabling full compromise of confidentiality, integrity, and availability. The weakness is a CWE-693 type flaw, representing improper control of secure booleans, which underpins the bypass of safe-guarded directives.

The issue affects all installations of Nginx UI older than version 2.4.1. The product is produced by 0xJacky and any deployment using the web user interface prior to the noted release is vulnerable.

The CVSS score of 8.3 indicates a high‑severity vulnerability. The exploit requires the attacker to have secondary authenticated access to the MCP configuration interface, but once authenticated, no additional privileges are needed. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting it has not yet been widely exploited in the wild. Nonetheless, the potential impact of executing arbitrary JavaScript in the Nginx worker makes this a serious threat for environments where secondary users exist.