CVE-2026-63496— augment-vir: Shell Command Injection in `grep()` via Unsanitized `searchPattern`

Quick assessment

Affected

electrovir augment-vir

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

augment-vir 是一个辅助函数集合。在版本 31.73.5 之前，@augment-vir/node 导出的 grep() 函数会将调用者可控的搜索模式直接插入到双引号包裹的 shell 命令字符串中，且未进行任何清理处理（grep.ts:310）。当构造出的命令通过 spawn() 函数并设置 shell: 'bash' 执行时（shell.ts:98-99），bash 会解析并执行模式中嵌入的 $() 命令替换表达式，从而导致以 Node.js 进程用户身份执行任意操作系统命令。任何将未经信任的输入传递

CVSS 7.8 · High Updated Nov 10, 2026

Possible ATT&CK Techniques 2 AI

T1190 · Exploit Public-Facing Application T1059.004 · Unix Shell

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

augment-vir: Shell Command Injection in `grep()` via Unsanitized `searchPattern`

Source: CVE Program / CVE List V5

Vulnerability Description

augment-vir is a collection of helper functions. Prior to version 31.73.5, the grep() function exported by @augment-vir/node inserts caller-controlled search patterns directly into a double-quoted shell command string without sanitization (grep.ts:310). When the constructed command is passed to spawn() with shell: 'bash' (shell.ts:98-99), bash evaluates $() command substitution expressions embedded in the pattern, resulting in arbitrary OS command execution as the Node.js process user. Any downstream application that passes untrusted input to grep()'s pattern or patterns field is vulnerable to unauthenticated local (and potentially remote) code execution. This issue has been patched in version 31.73.5.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

OS命令中使用的特殊元素转义处理不恰当(OS命令注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
electrovir	augment-vir	< 31.73.5	-

II. Public POCs for CVE-2026-63496

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-63496

请登录查看更多情报信息。

Other References for CVE-2026-63496 (3)

https://github.com/electrovir/augment-vir/releases/tag/v31.73.5 x_refsource_MISC
https://github.com/electrovir/augment-vir/security/advisories/GHSA-xvcc-vqjv-phqh x_refsource_CONFIRM
https://github.com/electrovir/augment-vir/commit/9e1a3592903a56e500959be72276ede1708c3437 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-63496

IV. Related Vulnerabilities

Same weakness: CWE-78