Most recent entries from all

cnvd-2022-88820

EUVD-2026-232606

fkie_cve-2022-39243

NuProcess is an external process execution implementation for Java. In all the versions of NuProcess where it forks processes by using the JVM's Java_java_lang_UNIXProcess_forkAndExec method (1.2.0+), attackers can use NUL characters in their strings to perform command line injection. Java's ProcessBuilder isn't vulnerable because of a check in ProcessBuilder.start. NuProcess is missing that check. This vulnerability can only be exploited to inject command line arguments on Linux. Version 2.0.5 contains a patch. As a workaround, users of the library can sanitize command strings to remove NUL characters prior to passing them to NuProcess for execution.

GHSA-cxgf-v2p8-7ph7 — NuProcess vulnerable to command-line injection through insertion of NUL character(s)

Affected: Maven: com.zaxxer:nuprocess

### Impact In all the versions of NuProcess where it forks processes by using the JVM's Java_java_lang_UNIXProcess_forkAndExec method (1.2.0+), attackers can use NUL characters in their strings to perform command line injection. Java's ProcessBuilder isn't vulnerable because of a check in ProcessBuilder.start. NuProcess is missing that check.

This vulnerability can only be exploited to inject command line arguments on Linux. - On macOS, any argument with a NUL character is truncated at that character. This means the malicious arguments are never seen by the started process. - On Windows, the entire command line is truncated at the first NUL character. This means the malicious arguments, and any intentional arguments provided after them, are never seen by the started process.

### Patches 2.0.5

### Workarounds Users of the library can sanitize command strings to remove NUL characters prior to passing them to NuProcess for execution.

### References None.

gsd-2022-39243

UBUNTU-CVE-2022-39243

Affected: Ubuntu:20.04:LTS: watchman, Ubuntu:22.04:LTS: watchman, Ubuntu:24.04:LTS: watchman, Ubuntu:25.10: watchman, Ubuntu:26.10: watchman, Ubuntu:26.04:LTS: watchman