CVE-2026-19046: medium-severity vulnerability in NocteDefensor LudusMCP
NocteDefensor LudusMCP ludus_environment_guides_search ludusEnvironmentGuidesSearch.ts path traversal
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.8epss 0.2%
A security vulnerability has been detected in NocteDefensor LudusMCP up to 1.0.24. The impacted element is an unknown function of the file src/tools/ludusEnvironmentGuidesSearch.ts of the component ludus_environment_guides_search. Such manipulation of the argument guide_name leads to path traversal. Local access is required to approach this attack. The project was informed of the problem early through an issue report but has not responded yet.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X
Affected products
NocteDefensor · LudusMCPRelated CVEs — NocteDefensor LudusMCP
In the same product, most dangerous first.
CVE-2026-19047MEDIUMNocteDefensor LudusMCP ludus_cli_execute cliWrapper.ts executeCommand command injectionEPSS 1.1%CVE-2026-19045MEDIUMNocteDefensor LudusMCP get_credential_from_user secretDialog.ts SecretDialog.showSecretDialog command injectionEPSS 0.8%CVE-2026-19367MEDIUMNocteDefensor LudusMCP read_range_config rangeConfig.ts server-side request forgeryEPSS 0.3%CVE-2026-19366MEDIUMNocteDefensor LudusMCP insert_creds_range_config insertCredsRangeConfig.ts path traversalEPSS 0.2%