CVE-2022-39243: NuProcess vulnerable to command-line injection through insertion of NUL character(s)

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-09-26 · updated 2026-06-17
Weakness: CWE-77

Description

NuProcess is an external process execution implementation for Java. In all the versions of NuProcess where it forks processes by using the JVM's Java_java_lang_UNIXProcess_forkAndExec method (1.2.0+), attackers can use NUL characters in their strings to perform command line injection. Java's ProcessBuilder isn't vulnerable because of a check in ProcessBuilder.start. NuProcess is missing that check. This vulnerability can only be exploited to inject command line arguments on Linux. Version 2.0.5 contains a patch. As a workaround, users of the library can sanitize command strings to remove NUL characters prior to passing them to NuProcess for execution.

Affected products

brettwooldridge NuProcess: from 1.2.0 before 2.0.5 — fixed in 2.0.5

How to fix

Upgrade to a fixed version: brettwooldridge NuProcess 2.0.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-39243 or the next vulnerability affects your stack