github.com/0xJacky/Nginx-UI issue could allow unintended commands to run

What happened

• Nginx UI: MCP nginx_config_add Bypasses Directive Validation — Authenticated RCESecurity Advisory GHSA-9jww-cxg5-rj9m
• The MCP tool nginxconfigadd writes nginx configuration files to disk and triggers an nginx reload without calling config.ValidateConfigFile. The identical flow in the REST API (POST /api/configs) does call that function and correctly rejects dangerous directives.Advisory description (GHSA-9jww-cxg5-rj9m)

Contributing factors stated by the source

• The MCP tool nginxconfigadd writes nginx configuration files to disk and triggers an nginx reload without calling config.ValidateConfigFile. The identical flow in the REST API (POST /api/configs) does call that function and correctly rejects dangerous directives.

The failure pattern

Related standards

CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.

• ASI01 Agent Goal Hijack
• ASI02 Tool Misuse and Exploitation
• ASI03 Identity and Privilege Abuse
• ASI06 Memory and Context Poisoning
• ASI10 Rogue Agents
• LLM01 Prompt Injection
• LLM02 Sensitive Information Disclosure
• LLM03 Excessive Agency
• LLM10 Improper Output Handling
• AC-3 Access Enforcement
• AC-4 Information Flow Enforcement
• AC-5 Separation of Duties
• AC-6 Least Privilege
• SI-10 Information Input Validation
• RV.3.4 Update the development process
• MAP 5.1 Estimate impacts from past uses and public incident reports
• Goal 3 Reducing entire classes of vulnerability
• CWE-862 Missing Authorization
• CWE-1427 Improper Neutralization of Input Used for LLM Prompting
• CWE-250 Execution with Unnecessary Privileges

Incidents with the same pattern