CVE-2026-44444: falha crítica em prolix-oc Lumiverse
Lumiverse: Spindle extension install runs untrusted lifecycle scripts before security scan
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.1epss 0.4%
Lumiverse is a full-featured AI chat application. Prior to 0.9.7, the Spindle extension build pipeline calls bun install without the --ignore-scripts flag before running the static backend safety scan (assertSafeBackendBundle). A malicious extension that ships a package.json with a preinstall, postinstall, or prepare lifecycle script achieves host-level code execution the moment an admin presses Install before any dist file is inspected. This vulnerability is fixed in 0.9.7.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
prolix-oc · LumiverseCVEs relacionadas — prolix-oc Lumiverse
No mesmo produto, das mais perigosas para as menos.
CVE-2026-44449CRITICALLumiverse: SMB `exists()` basename injection via smbclient `!cmd` escapeEPSS 0.5%CVE-2026-44450CRITICALLumiverse: RCE via MCP stdio argument injectionEPSS 0.4%CVE-2026-44451CRITICALLumiverse: TSX component sandbox escape via DOM ref and string-split identifier bypassEPSS 0.2%CVE-2026-44443MEDIUMLumiverse: Sign-up nonce race condition allows unauthorized account registrationEPSS 0.1%