TI-2022-18620 Aliases CVE-2022-39243 GHSA-cxgf-v2p8-7ph7

NuProcess vulnerable to command-line injection through insertion of NUL character(s)

HIGH 76CWE-77Published 2022-09-26 · Updated 2025-04-22

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-77.

Summary

NuProcess is an external process execution implementation for Java. In all the versions of NuProcess where it forks processes by using the JVM's Java_java_lang_UNIXProcess_forkAndExec method (1.2.0+), attackers can use NUL characters in their strings to perform command line injection. Java's ProcessBuilder isn't vulnerable because of a check in ProcessBuilder.start. NuProcess is missing that check. This vulnerability can only be exploited to inject command line arguments on Linux. Version 2.0.5 contains a patch. As a workaround, users of the library can sanitize command strings to remove NUL characters prior to passing them to NuProcess for execution.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.0156 75th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed NuProcess (brettwooldridge): 2.0.5com.zaxxer:nuprocess (Maven): 2.0.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
brettwooldridge	NuProcess	1.2.0 to before 2.0.5	2.0.5	Patch available	CNA
—	com.zaxxer:nuprocess (Maven)	1.2.0 to before 2.0.5	2.0.5	Patch available	GHSA-cxgf-v2p8-7ph7

NuProcess Vendorbrettwooldridge Affected 1.2.0 to before 2.0.5 Fixed in 2.0.5 Patch available CNA
com.zaxxer:nuprocess (Maven) Vendor— Affected 1.2.0 to before 2.0.5 Fixed in 2.0.5 Patch available GHSA-cxgf-v2p8-7ph7

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:nuprocess_project:nuprocess::::::::	1.2.0 to before 2.0.5	Vulnerable	Nuprocess Project
cpe:2.3:o:linux:linux_kernel:-:::::::*	not specified by NVD	Running on	Linux

cpe:2.3:a:nuprocess_project:nuprocess:*:*:*:*:*:*:*:* Versions 1.2.0 to before 2.0.5 Vulnerable ·Nuprocess Project
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux

Remediation

Fix · CNA NuProcess (brettwooldridge) Fixed in 2.0.5
Fix · GHSA-cxgf-v2p8-7ph7 com.zaxxer:nuprocess (Maven) Fixed in 2.0.5 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-39243
2026-10-03 Alias added: GHSA-cxgf-v2p8-7ph7

References

Exploit 1

https://github.com/brettwooldridge/NuProcess/pull/143

Patch 1

https://github.com/brettwooldridge/NuProcess/commit/29bc09de561bf00ff9bf77123756363a9709f868

Advisory 2

Other 1

https://github.com/brettwooldridge/NuProcess

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences