CVE-2026-44450
Received Received - Intake
Code Execution in Lumiverse AI Chat Application

Publication date: 2026-05-26

Last updated on: 2026-05-26

Assigner: GitHub, Inc.

Description
Lumiverse is a full-featured AI chat application. Prior to 0.9.7, the MCP server creation endpoint validates the command field against an allowlist of binary names but forwards the args array to the child process without any validation. Every binary on the allowlist accepts an inline-code execution flag (-e for node/bun, -c for python3/deno), giving any logged-in user arbitrary OS-level code execution on the Lumiverse server. The route requires only requireAuth (not requireOwner). The server binds on all interfaces (::) and the host-header rebinding check is bypassed trivially by any HTTP client that sends Host: localhost:<port> directly, making this exploitable from any machine with network access to the server port. This vulnerability is fixed in 0.9.7.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-26
Last Modified
2026-05-26
Generated
2026-05-27
AI Q&A
2026-05-27
EPSS Evaluated
N/A
NVD
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
lumiverse lumiverse to 0.9.7 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-88 The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability exists in Lumiverse, an AI chat application, prior to version 0.9.7. The MCP server creation endpoint validates the command field against an allowlist of binary names but does not validate the arguments passed to these binaries. Since every binary on the allowlist accepts an inline-code execution flag (such as -e for node/bun or -c for python3/deno), any logged-in user can execute arbitrary operating system-level code on the Lumiverse server. The endpoint requires only user authentication, not ownership, and the server listens on all network interfaces. Additionally, the host-header rebinding check can be bypassed easily, allowing exploitation from any machine with network access to the server port.


How can this vulnerability impact me? :

This vulnerability allows any authenticated user to execute arbitrary code on the Lumiverse server at the operating system level. This can lead to complete compromise of the server, including unauthorized access to data, modification or deletion of files, installation of malware, and disruption of services. Because the server listens on all interfaces and the host-header check can be bypassed, attackers can exploit this vulnerability remotely if they have network access to the server port.


What immediate steps should I take to mitigate this vulnerability?

To mitigate this vulnerability, upgrade Lumiverse to version 0.9.7 or later, where the issue is fixed.

Additionally, restrict network access to the Lumiverse server port to trusted hosts only, since the server binds on all interfaces and is exploitable from any machine with network access.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart