CVE-2026-44450
Deferred Deferred - Pending Action
Code Execution in Lumiverse AI Chat Application

Publication date: 2026-05-26

Last updated on: 2026-05-26

Assigner: GitHub, Inc.

Description
Lumiverse is a full-featured AI chat application. Prior to 0.9.7, the MCP server creation endpoint validates the command field against an allowlist of binary names but forwards the args array to the child process without any validation. Every binary on the allowlist accepts an inline-code execution flag (-e for node/bun, -c for python3/deno), giving any logged-in user arbitrary OS-level code execution on the Lumiverse server. The route requires only requireAuth (not requireOwner). The server binds on all interfaces (::) and the host-header rebinding check is bypassed trivially by any HTTP client that sends Host: localhost:<port> directly, making this exploitable from any machine with network access to the server port. This vulnerability is fixed in 0.9.7.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-26
Last Modified
2026-05-26
Generated
2026-06-16
AI Q&A
2026-05-27
EPSS Evaluated
2026-06-14
NVD
CVE-2026-44450
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
lumiverse lumiverse to 0.9.7 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-88 The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in Lumiverse, an AI chat application, prior to version 0.9.7. The MCP server creation endpoint validates the command field against an allowlist of binary names but does not validate the arguments passed to these binaries. Since every binary on the allowlist accepts an inline-code execution flag (such as -e for node/bun or -c for python3/deno), any logged-in user can execute arbitrary operating system-level code on the Lumiverse server. The endpoint requires only user authentication, not ownership, and the server listens on all network interfaces. Additionally, the host-header rebinding check can be bypassed easily, allowing exploitation from any machine with network access to the server port.

Impact Analysis

This vulnerability allows any authenticated user to execute arbitrary code on the Lumiverse server at the operating system level. This can lead to complete compromise of the server, including unauthorized access to data, modification or deletion of files, installation of malware, and disruption of services. Because the server listens on all interfaces and the host-header check can be bypassed, attackers can exploit this vulnerability remotely if they have network access to the server port.

Mitigation Strategies

To mitigate this vulnerability, upgrade Lumiverse to version 0.9.7 or later, where the issue is fixed.

Additionally, restrict network access to the Lumiverse server port to trusted hosts only, since the server binds on all interfaces and is exploitable from any machine with network access.

Compliance Impact

This vulnerability allows any logged-in user to execute arbitrary OS-level code on the Lumiverse server due to insufficient validation of command arguments. Given the high severity (CVSS 9.9) and the ability to execute code remotely, this could lead to unauthorized access, data breaches, and potential compromise of sensitive information.

Such unauthorized access and potential data breaches can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require strict controls to protect personal and sensitive data from unauthorized access and ensure system integrity.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-44450. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart