The vulnerability allows malicious manipulation of the URL argument passed to the child_process.exec function in the nexus_reauth module of the nexus-mcp tool, resulting in arbitrary command execution on the host. This injection flaw permits attackers to run arbitrary shell commands, potentially compromising confidentiality, integrity, and availability of the system where the tool is deployed. The flaw is classified as an OS command injection (CWE-77) affecting input handling (CWE-74).

The affected product is nexus-mcp, an open-source monitoring and control tool distributed by 0-Gaurav-0. No specific version information is available because the project employs a rolling release model, so any revision maintained in its current repository may be impacted until an update is made available.

The CVSS score of 5.3 indicates a moderate severity, with the exploit possible from remote sources. No EPSS score is published, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw by providing a crafted URL argument to the browser.ts component; because child_process.exec is used, the arguments are executed in a shell context, giving full shell access. The public nature of the exploit and lack of an immediate patch increase the practical risk.