CVE-2026-125358

HIGH 8.1

Universal-modder before e88f687 Cross-Site WebSocket Command Execution via HostLink

CVSS Score

8.1

EPSS Score

0.0%

EPSS Percentile

0th

Universal-modder before commit e88f6876745427321eb755ebc98276063a962d8a contains a missing WebSocket Origin validation vulnerability in the HostLink class of its passthrough example mods that allows remote attackers to execute Minecraft commands. Any web page open in the player's browser can connect cross-site to the unauthenticated loopback WebSocket and send cmd messages that WorldBridge.command() runs with operator authority.

CWE	CWE-1385
Vendor	rehan-remade
Product	universal-modder
Published	Nov 9, 2026

Stay Ahead of the Next One

Get instant alerts for rehan-remade universal-modder

Be the first to know when new high vulnerabilities affecting rehan-remade universal-modder are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Affected Versions

rehan-remade / universal-modder

0 < e88f6876745427321eb755ebc98276063a962d8a

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/rehan-remade/universal-modder/security/advisories/GHSA-wjf6-3h6v-4gq9 github.com: https://github.com/rehan-remade/universal-modder/commit/e88f6876745427321eb755ebc98276063a962d8a github.com: https://github.com/rehan-remade/universal-modder/blob/edf45f6a26cb047886d9d7bcba392c328fc3d317/examples/minecraft-gta5-passthrough/mc/src/client/java/dev/rehan/passthrough/client/HostLink.java#L54-L72 vulncheck.com: https://www.vulncheck.com/advisories/universal-modder-before-e88f687-cross-site-websocket-command-execution-via-hostlink

Credits

George Chen