Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
@pensar/apex <= 0.0.58 is vulnerable to OS command injection via the smart_enumerate tool. The createSmartEnumerateTool() function in src/core/agent/tools.ts constructs a shell command by concatenating unsanitized values from the extensions array and url parameter into a string passed to Node.js child_process.exec(). Because exec() spawns a shell, shell metacharacters in those values are interpreted by the host shell, resulting in arbitrary OS command execution with the privileges of the running process. NOTE: this is disputed by the Supplier because the report is about intended behavior, as explained in the Security Policy of the pensarai/apex GitHub repo.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-36044 @pensar/apex <= 0.0.58の脆弱性をわかりやすく解説｜影響範囲と対策まとめ https://www.cybernote.click/2026/06/11/cve-2026-36044-pensarapex-0058/ #IT #Security #cybersecurity
Post summary
The tweet links to a blog post explaining CVE‑2026‑36044 for pensar/apex ≤0.0.58 but provides no proof‑of‑concept, exploit details, or evidence of active exploitation.