augment-vir: Shell Command Injection in `grep()` via Unsanitized `searchPattern`
Affects downstream applications that pass untrusted input to augment-vir's grep() and run the built command through spawn() with shell set to bash. Fixed in 31.73.5.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 31.73.5
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. The application passes untrusted input to grep()'s pattern or patterns field The constructed command is run through spawn() with shell set to bash
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 13/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Affected software is the augment-vir helper library, specifically its grep() function exported by @augment-vir/node. A local attacker who can get untrusted input into grep()'s pattern or patterns field, without logging in and with a user needing to take some action, can run arbitrary OS commands as the Node.js process user through shell command substitution.
Read the original description
augment-vir is a collection of helper functions. Prior to version 31.73.5, the grep() function exported by @augment-vir/node inserts caller-controlled search patterns directly into a double-quoted shell command string without sanitization (grep.ts:310). When the constructed command is passed to spawn() with shell: 'bash' (shell.ts:98-99), bash evaluates $() command substitution expressions embedded in the pattern, resulting in arbitrary OS command execution as the Node.js process user. Any downstream application that passes untrusted input to grep()'s pattern or patterns field is vulnerable to unauthenticated local (and potentially remote) code execution. This issue has been patched in version 31.73.5.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure5/25Specific setups only
- Reach?/20Unknown. No tracked technology or package matched
- Severity7.8/10CVSS 7.8
- No patch0/5No signal
What would change the score
- Would score about 63 if added to CISA KEV
- Would score about 58 if CISA's SSVC rates exploitation active
- Would score about 23 if CISA's SSVC rates it automatable
What to do
Check whether your setup matches what the bug needs.
The application passes untrusted input to grep()'s pattern or patterns field The constructed command is run through spawn() with shell set to bashUpgrade to a fixed version: 31.73.5.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- electrovir augment-vir
fixed in 31.73.5
Evidence 3
- Advisory
- Repository
- Repository
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-63496
Is CVE-2026-63496 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
grep() builds a shell command from the search pattern without sanitizing it, so $() command substitution inside the pattern can run arbitrary OS commands as the Node.js process user.Source: github.com, github.com
Which versions are affected by CVE-2026-63496?
augment-vir: before 31.73.5.Source: cve.now feed data
Am I affected, and how do I check?
The affected package is augment-vir before 31.73.5. The issue applies only where untrusted input reaches grep()'s pattern or patterns field and the command is passed to spawn() with shell set to bash. Check the installed augment-vir version in the lockfile or with npm ls augment-vir, and check whether any code passes external input to grep().Source: github.com, github.com
How do I fix CVE-2026-63496?
Upgrade augment-vir to 31.73.5, which contains the fix (see the v31.73.4...v31.73.5 comparison). No workaround is listed in the checked facts.Source: github.com, github.com