CVE-2026-36044

@pensar/apex <= 0.0.58 is vulnerable to OS command injection via the smart_enumerate tool. The createSmartEnumerateTool() function in src/core/agent/tools.ts constructs a shell command by concatenating unsanitized values from the extensions array and url parameter into a string passed to Node.js child_process.exec(). Because exec() spawns a shell, shell metacharacters in those values are interpreted by the host shell, resulting in arbitrary OS command execution with the privileges of the running process. NOTE: this is disputed by the Supplier because the report is about intended behavior, as explained in the Security Policy of the pensarai/apex GitHub repo.

• CWE-78

• https://gist.github.com/NucleiAv/47e87da08b90ef464fd9b35affe578fb
• https://github.com/pensarai/apex/security
• https://www.npmjs.com/package/@pensar/apex

Published

May 27, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-3602IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12…5.5
• CVE-2026-36027An issue in Code27 Companion Hub SQ3A.220705.003.A1 allows a…6.8
• CVE-2026-36028A protection mechanism failure in the Code 27 Companion Hub …6.8
• CVE-2026-3603IBM Engineering Lifecycle Management 7.0.3 Interim Fix 001 t…7.1
• CVE-2026-36035Incorrect access control in the /api/License/deactivateOffli…6.5
• CVE-2026-3604The WP SEO Structured Data Schema plugin for WordPress is vu…4.9
• CVE-2026-36045picoclaw <=v0.1.2 and earlier is vulnerable to OS command in…7.3
• CVE-2026-3605An authenticated user with access to a kvv2 path through a p…8.1
• CVE-2026-3606A vulnerability has been found in Ettercap 0.8.4-Garofalo. A…5.5
• CVE-2026-3607GitLab has remediated an issue in GitLab CE/EE affecting all…4.3
• CVE-2026-3608Sending a maliciously crafted message to the kea-ctrl-agent,…7.5
• CVE-2026-3609Wellbia's XIGNCODE3 xhunter1.sys kernel driver, version 10.0…7.8