https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-19T15:08:31.637509+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2022-88820 cnvd-2022-88820 2026-10-19T15:08:31.640938+00:00 cnvd-2022-88820 https://cve.radiocsirt.org/vuln/euvd-2026-232606 EUVD-2026-232606 2026-10-19T15:08:31.640973+00:00 EUVD-2026-232606 https://cve.radiocsirt.org/vuln/fkie_cve-2022-39243 fkie_cve-2022-39243 2026-10-19T15:08:31.640988+00:00

NuProcess is an external process execution implementation for Java. In all the versions of NuProcess where it forks processes by using the JVM's Java_java_lang_UNIXProcess_forkAndExec method (1.2.0+), attackers can use NUL characters in their strings to perform command line injection. Java's ProcessBuilder isn't vulnerable because of a check in ProcessBuilder.start. NuProcess is missing that check. This vulnerability can only be exploited to inject command line arguments on Linux. Version 2.0.5 contains a patch. As a workaround, users of the library can sanitize command strings to remove NUL characters prior to passing them to NuProcess for execution.

 https://cve.radiocsirt.org/vuln/ghsa-cxgf-v2p8-7ph7 GHSA-cxgf-v2p8-7ph7 — NuProcess vulnerable to command-line injection through insertion of NUL character(s) 2026-10-19T15:08:31.641024+00:00

Affected: Maven: com.zaxxer:nuprocess

### Impact In all the versions of NuProcess where it forks processes by using the JVM's Java_java_lang_UNIXProcess_forkAndExec method (1.2.0+), attackers can use NUL characters in their strings to perform command line injection. Java's ProcessBuilder isn't vulnerable because of a check in ProcessBuilder.start. NuProcess is missing that check.

This vulnerability can only be exploited to inject command line arguments on Linux. - On macOS, any argument with a NUL character is truncated at that character. This means the malicious arguments are never seen by the started process. - On Windows, the entire command line is truncated at the first NUL character. This means the malicious arguments, and any intentional arguments provided after them, are never seen by the started process.

### Patches 2.0.5

### Workarounds Users of the library can sanitize command strings to remove NUL characters prior to passing them to NuProcess for execution.

### References None.

 https://cve.radiocsirt.org/vuln/gsd-2022-39243 gsd-2022-39243 2026-10-19T15:08:31.641057+00:00 gsd-2022-39243 https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-39243 UBUNTU-CVE-2022-39243 2026-10-19T15:08:31.641069+00:00

Affected: Ubuntu:20.04:LTS: watchman, Ubuntu:22.04:LTS: watchman, Ubuntu:24.04:LTS: watchman, Ubuntu:25.10: watchman, Ubuntu:26.10: watchman, Ubuntu:26.04:LTS: watchman

NuProcess is an external process execution implementation for Java. In all the versions of NuProcess where it forks processes by using the JVM's Java_java_lang_UNIXProcess_forkAndExec method (1.2.0+), attackers can use NUL characters in their strings to perform command line injection. Java's ProcessBuilder isn't vulnerable because of a check in ProcessBuilder.start. NuProcess is missing that check. This vulnerability can only be exploited to inject command line arguments on Linux. Version 2.0.5 contains a patch. As a workaround, users of the library can sanitize command strings to remove NUL characters prior to passing them to NuProcess for execution.