CVE-2026-36044
@pensar/apex <= 0.0.58 is vulnerable to OS command injection via the smart_enumerate tool. The createSmartEnumerateTool() function in src/core/agent/tools.ts constructs a shell command by concatenating unsanitized values from the extensions array and url parameter into a string passed to Node.js child_process.exec(). Because exec() spawns a shell, shell metacharacters in those values are interpreted by the host shell, resulting in arbitrary OS command execution with the privileges of the running process. NOTE: this is disputed by the Supplier because the report is about intended behavior, as explained in the Security Policy of the pensarai/apex GitHub repo.
| Vendor | n/a |
| Product | n/a |
| Published | May 27, 2026 |
| Last Updated | Jun 3, 2026 |
Get instant alerts for n/a n/a
Be the first to know when new high vulnerabilities affecting n/a n/a are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:R