CVE-2026-19045

MEDIUM 5.3

NocteDefensor LudusMCP get_credential_from_user secretDialog.ts SecretDialog.showSecretDialog command injection

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

A weakness has been identified in NocteDefensor LudusMCP up to 1.0.24. The affected element is the function SecretDialog.showSecretDialog of the file src/utils/secretDialog.ts of the component get_credential_from_user. This manipulation of the argument Description causes command injection. It is possible to launch the attack on the local host. The project was informed of the problem early through an issue report but has not responded yet.

CWE	CWE-77 CWE-74
Vendor	noctedefensor
Product	ludusmcp
Published	Aug 6, 2026

Stay Ahead of the Next One

Get instant alerts for noctedefensor ludusmcp

Be the first to know when new medium vulnerabilities affecting noctedefensor ludusmcp are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

NocteDefensor / LudusMCP

1.0.0 1.0.1 1.0.2 1.0.3 1.0.4 1.0.5 1.0.6 1.0.7 1.0.8 1.0.9 1.0.10 1.0.11 1.0.12 1.0.13 1.0.14 1.0.15 1.0.16 1.0.17 1.0.18 1.0.19 1.0.20 1.0.21 1.0.22 1.0.23 1.0.24

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/386492 vuldb.com: https://vuldb.com/vuln/386492/cti vuldb.com: https://vuldb.com/cve/CVE-2026-19045 vuldb.com: https://vuldb.com/submit/863833 github.com: https://github.com/gongyanyugyy/public_exp/issues/1 github.com: https://github.com/NocteDefensor/LudusMCP/issues/2 github.com: https://github.com/NocteDefensor/LudusMCP/

Credits

🔍 gongyanyu (VulDB User) VulDB CNA Team