CVE-2026-36044: @pensar/apex OS Command Injection

What Happened, in Brief

CVE-2026-36044 is an @pensar/apex vulnerability involving potential shell command injection in the npm package’s smart_enumerate tool. According to the NVD description, the tool constructs a shell command using values from the extensions array and url parameter. Those values are passed to Node.js child_process.exec(), which invokes a shell and can interpret shell metacharacters.

If an attacker can influence those parameters, the reported behavior may allow arbitrary operating-system command execution with the privileges of the process running @pensar/apex. The practical impact depends on how the package is deployed, whether smart_enumerate receives untrusted input, and the operating-system permissions available to the application.

The score and affected range are reported data, not proof that every deployment is remotely exploitable. Determine whether untrusted users, agents, integrations, or network clients can control the relevant parameters.

Analyst’s Take: Treat this as an exposure-triage problem before treating it as a package-wide emergency. The highest-priority systems are those where untrusted data reaches smart_enumerate and the Node.js process can access credentials, sensitive files, or other network services. The supplier’s dispute and the absence of confirmed in-the-wild exploitation leave uncertainty, but neither changes the need to review those call paths.

What’s the Root Cause?

The reported root cause is unsafe construction of a shell command. The affected code path reportedly takes values from the extensions array and url parameter, concatenates them into a command string, and executes that string through Node.js child_process.exec().

This matters because exec() runs a command through a shell. Shell metacharacters and control operators can change how the shell parses the command. Depending on the exact input path and runtime environment, characters such as command separators, substitutions, redirections, or pipelines may cause additional commands to execute.

The risk is not limited to the package’s intended enumeration function. Successful command injection could expose environment variables, application secrets, source code, tokens, cloud credentials, local files, and any network-accessible services available to the process. A compromise may also provide a foothold for persistence or lateral movement if the application runs with excessive privileges.

The supplier disputes the report, stating that the behavior is intended under the project’s security policy. That dispute does not eliminate operational risk. Defenders should distinguish between the project’s intended trust model and their own deployment model: a function designed for trusted input can become a vulnerability when exposed to untrusted users, automated agents, external requests, or tenant-controlled data.

Who Needs to Act

Organizations using @pensar/apex version 0.0.58 or earlier should investigate immediately. The retrieved NVD record identifies the affected range as:

@pensar/apex <= 0.0.58

No additional affected products, package names, or version branches were identified in the available material. The issue is associated with the smart_enumerate tool and its createSmartEnumerateTool() implementation in src/core/agent/tools.ts.

Prioritize systems where any of the following conditions apply:

• url or extensions values originate from HTTP requests, chat prompts, uploaded content, plugins, integrations, or tenant data.
• The package runs in a server, worker, CI job, container, or automation service.
• The process has access to cloud credentials, SSH keys, deployment tokens, source repositories, or sensitive filesystem paths.
• The application is reachable by users or services outside the organization’s trusted administrative boundary.
• Multiple customers or business units share the same runtime or host.

A package-lock file, npm manifest, container image, or software bill of materials can confirm whether the dependency is present. For npm projects, search both direct and transitive dependencies:

npm ls @pensar/apex --all
grep -R '"@pensar/apex"' package.json package-lock.json npm-shrinkwrap.json 2>/dev/null

A deployment that does not expose smart_enumerate to untrusted input may have lower practical exposure. Review the call path and trust boundaries before treating it as unaffected.

For broader incident handling, review these incident response fundamentals when deciding how to preserve evidence and coordinate remediation.

Why This CVSS Score?

NVD reports a CVSS v3 base score of 8.8, High. The retrieved record did not include the complete CVSS vector string. The individual vector components, including the exact attack vector, attack complexity, privileges required, user interaction, scope, confidentiality, integrity, and availability impacts, therefore cannot be stated reliably.

The score is consistent with the potential severity of command injection: arbitrary operating-system command execution can affect confidentiality, integrity, and availability. It does not establish that the vulnerability is exploitable over the public internet, requires no authentication, or affects every installation. Those conclusions require the missing vector and an application-specific analysis.

Do not fill in unknown scoring components by assumption. Confirm the complete vector through the authoritative NVD record or a subsequent vendor advisory before using it for precise risk ranking. Until then, use the potential impact of arbitrary command execution and the deployment’s actual exposure to prioritize remediation.

A practical risk assessment should consider:

1. Whether an attacker can supply or influence url or extensions.
2. Whether the smart_enumerate tool is reachable from an untrusted interface.
3. Which operating-system account runs the Node.js process.
4. Whether secrets and administrative interfaces are accessible from that account.
5. Whether the package runs in a hardened, isolated environment.

Has It Been Exploited?

A public disclosure or proof-of-concept reference is available at the following GitHub Gist:

https://gist.github.com/NucleiAv/47e87da08b90ef464fd9b35affe578fb

The available information supports classifying a public PoC or disclosure reference as present. It does not establish that the material has been tested successfully against every affected version or deployment configuration. Validate any testing only in an isolated environment, and do not run untrusted PoC material on production systems.

Confirmed in-the-wild exploitation has not been established by the retrieved sources. CVE-2026-36044 is not listed in the CISA Known Exploited Vulnerabilities catalog, and no reliable evidence of an active ransomware campaign was identified. There is consequently no CISA KEV remediation deadline associated with this CVE at the time of this article.

The supplier also disputes the vulnerability and describes the behavior as intended under the project’s security policy. That position creates uncertainty around exploitability and remediation, but it is not a reason to ignore deployments that pass untrusted data into the affected function. Treat public exploit material as a risk amplifier while monitoring for authoritative updates.