CVE-2026-19047: falha de média gravidade em NocteDefensor LudusMCP
NocteDefensor LudusMCP ludus_cli_execute cliWrapper.ts executeCommand command injection
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.8epss 1.1%
A vulnerability was detected in NocteDefensor LudusMCP up to 1.0.24. This affects the function executeArbitraryCommand/executeCommand of the file src/ludusMCP/cliWrapper.ts of the component ludus_cli_execute. Performing a manipulation of the argument command/args results in command injection. The attack needs to be approached locally. The project was informed of the problem early through an issue report but has not responded yet.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Produtos afetados
NocteDefensor · LudusMCPCVEs relacionadas — NocteDefensor LudusMCP
No mesmo produto, das mais perigosas para as menos.
CVE-2026-19045MEDIUMNocteDefensor LudusMCP get_credential_from_user secretDialog.ts SecretDialog.showSecretDialog command injectionEPSS 0.8%CVE-2026-19367MEDIUMNocteDefensor LudusMCP read_range_config rangeConfig.ts server-side request forgeryEPSS 0.3%CVE-2026-19366MEDIUMNocteDefensor LudusMCP insert_creds_range_config insertCredsRangeConfig.ts path traversalEPSS 0.2%CVE-2026-19046MEDIUMNocteDefensor LudusMCP ludus_environment_guides_search ludusEnvironmentGuidesSearch.ts path traversalEPSS 0.2%