Arbitrary Command Execution in augment-vir Node.js Library

CVE-2026-63496

What is CVE-2026-63496?

The augment-vir library prior to version 31.73.5 contains a security flaw in its grep() function, which allows for untrusted input to be executed as shell commands. Specifically, caller-controlled search patterns are inserted into a double-quoted shell command without proper sanitization. This vulnerability enables arbitrary command execution by passing manipulated input, leading to local and potentially remote code execution under the Node.js process user context. Users are advised to update to the patched version 31.73.5 to mitigate this risk.

References