{"id":"EUVD-2026-97905","enisaUuid":"6bd3edae-e5f7-3b24-ba93-23dfcc505638","description":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives such as load_module, js_import, and js_content. However, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content. This allows the user to load ngx_http_js_module.so, import attacker-controlled JavaScript, reload Nginx, and execute NJS in the Nginx worker context. This issue is fixed in version 2.4.1.","datePublished":"Oct 12, 2026, 9:03:36 PM","dateUpdated":"Oct 13, 2026, 8:23:50 PM","baseScore":8.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H","references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-5r62-gj48-897x\nhttps://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2\nhttps://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1\n","aliases":"CVE-2026-84319\nGHSA-5r62-gj48-897x\n","assigner":"GitHub_M","epss":0.28,"enisaIdProduct":[{"id":"f5438e7b-cacc-3f68-9a5d-31783d3ceb14","product":{"name":"nginx-ui","vendor":{"name":"0xJacky"}},"product_version":"\u003c 2.4.1"}],"enisaIdVendor":[{"id":"fb0bc95c-3225-370f-bc64-369a67b116e7","vendor":{"name":"0xJacky"}}],"enisaIdVulnerability":[{"id":"213f13cf-de4a-356a-80a5-8a8b32f0a1b4","vulnerability":{"id":"GHSA-5r62-gj48-897x","description":"Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context","datePublished":"Oct 15, 2026, 8:10:44 PM","dateUpdated":"Oct 15, 2026, 8:10:44 PM","baseScore":0.0,"references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-5r62-gj48-897x\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-84319\nhttps://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2\nhttps://github.com/0xJacky/nginx-ui\nhttps://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1\n","enisa_id":"EUVD-2026-97905\n","aliases":"GHSA-5r62-gj48-897x\nCVE-2026-84319\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:48 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"9471e35f-96df-3642-8563-00af80ccbb2e","vulnerability":{"id":"CVE-2026-84319","description":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives such as load_module, js_import, and js_content. However, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content. This allows the user to load ngx_http_js_module.so, import attacker-controlled JavaScript, reload Nginx, and execute NJS in the Nginx worker context. This issue is fixed in version 2.4.1.","datePublished":"Oct 12, 2026, 9:03:36 PM","dateUpdated":"Oct 13, 2026, 8:23:50 PM","status":"PUBLISHED","baseScore":8.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H","references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-5r62-gj48-897x\nhttps://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2\nhttps://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1\n","enisa_id":"EUVD-2026-97905\n","assigner":"GitHub_M","epss":0.28,"dataProcessed":"Nov 1, 2026, 7:14:05 AM","vulnerabilityProduct":[{"id":"00bf2d37-9898-3bec-863b-cf4bbc5383fc","product":{"name":"nginx-ui","vendor":{"name":"0xJacky"}},"product_version":"\u003c 2.4.1"}],"vulnerabilityVendor":[{"id":"92b1bc54-e5d2-34d6-b758-26ea9ac58c57","vendor":{"name":"0xJacky"}}]}}],"enisaIdAdvisory":[]}