CVE-2026-19045
Received Received - Intake

Command Injection in NocteDefensor LudusMCP

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: VulDB

Description
A weakness has been identified in NocteDefensor LudusMCP up to 1.0.24. The affected element is the function SecretDialog.showSecretDialog of the file src/utils/secretDialog.ts of the component get_credential_from_user. This manipulation of the argument Description causes command injection. It is possible to launch the attack on the local host. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-06
Last Modified
2026-08-06
Generated
2026-08-06
AI Q&A
2026-08-06
EPSS Evaluated
N/A
NVD
CVE-2026-19045
EUVD
EUVD-2026-53915

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
noctedefensor ludusmcp to 1.0.24 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a command injection vulnerability in NocteDefensor LudusMCP up to version 1.0.24. The issue occurs in the get_credential_from_user function where a user-controlled description parameter is passed directly into shell commands without proper escaping. This allows attackers to inject and execute arbitrary local commands on the system running the MCP server.

Detection Guidance

Check if LudusMCP version 1.0.24 or earlier is installed by running: npm list -g ludusmcp or checking the version in package.json. Inspect the secretDialog.ts file for vulnerable functions like showMacDialog, showZenityDialog, showKDialogDialog, or showSimpleWindowsDialog. Look for execSync calls that use the description parameter without sanitization.

Impact Analysis

An attacker could execute arbitrary local commands on your system with the privileges of the MCP server process. This could lead to unauthorized file access, data theft, system compromise, or installation of malware. The attack requires local access or control over MCP tool invocation.

Compliance Impact

This vulnerability could violate compliance requirements that mandate secure credential handling and protection against unauthorized command execution. GDPR may be impacted if personal data is exposed through command execution. HIPAA could be violated if protected health information is compromised.

Mitigation Strategies

Upgrade LudusMCP to the latest version if available. If no patch exists, disable the get_credential_from_user tool or restrict access to it. Avoid using the MCP server in untrusted environments. Monitor for suspicious activity in /tmp or system logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19045. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart