Vulnerability · Published Sep 26, 2022 · Assigned by GitHub_M
CVE-2022-39243NuProcess vulnerable to command-line injection through insertion of NUL character(s)
High 8.4
In plain English
A high-severity command injection in NuProcess from brettwooldridge. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 75% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
NuProcess is an external process execution implementation for Java. In all the versions of NuProcess where it forks processes by using the JVM's Java_java_lang_UNIXProcess_forkAndExec method (1.2.0+), attackers can use NUL characters in their strings to perform command line injection. Java's ProcessBuilder isn't vulnerable because of a check in ProcessBuilder.start. NuProcess is missing that check. This vulnerability can only be exploited to inject command line arguments on Linux. Version 2.0.5 contains a patch. As a workaround, users of the library can sanitize command strings to remove NUL characters prior to passing them to NuProcess for execution.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | com.zaxxer:nuprocess | 2.0.5 | GHSA-cxgf-v2p8-7ph7 |
| Ubuntu:22.04:LTS | watchman | no fix listed | UBUNTU-CVE-2022-39243 |
| Ubuntu:24.04:LTS | watchman | no fix listed | UBUNTU-CVE-2022-39243 |
| Ubuntu:25.10 | watchman | no fix listed | UBUNTU-CVE-2022-39243 |
| Ubuntu:26.04:LTS | watchman | no fix listed | UBUNTU-CVE-2022-39243 |
| Ubuntu:26.10 | watchman | no fix listed | UBUNTU-CVE-2022-39243 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| brettwooldridge | NuProcess | >= 1.2.0, < 2.0.5 |
Weakness: CWE-77 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H