CVE-2026-19045: medium-severity vulnerability in NocteDefensor LudusMCP
NocteDefensor LudusMCP get_credential_from_user secretDialog.ts SecretDialog.showSecretDialog command injection
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.8epss 0.8%
A weakness has been identified in NocteDefensor LudusMCP up to 1.0.24. The affected element is the function SecretDialog.showSecretDialog of the file src/utils/secretDialog.ts of the component get_credential_from_user. This manipulation of the argument Description causes command injection. It is possible to launch the attack on the local host. The project was informed of the problem early through an issue report but has not responded yet.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
NocteDefensor · LudusMCPRelated CVEs — NocteDefensor LudusMCP
In the same product, most dangerous first.
CVE-2026-19047MEDIUMNocteDefensor LudusMCP ludus_cli_execute cliWrapper.ts executeCommand command injectionEPSS 1.1%CVE-2026-19367MEDIUMNocteDefensor LudusMCP read_range_config rangeConfig.ts server-side request forgeryEPSS 0.3%CVE-2026-19366MEDIUMNocteDefensor LudusMCP insert_creds_range_config insertCredsRangeConfig.ts path traversalEPSS 0.2%CVE-2026-19046MEDIUMNocteDefensor LudusMCP ludus_environment_guides_search ludusEnvironmentGuidesSearch.ts path traversalEPSS 0.2%