CVE-2026-19045

MediumCVSS 5.3

Published: 06/08/2026(UTC)Updated: 12/08/2026(UTC)Translated: 06/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.62%

47th percentile - higher than 47% of all known CVEs

Summary

A command injection vulnerability was found in NocteDefensor LudusMCP up to version 1.0.24 in the SecretDialog.showSecretDialog function in src/utils/secretDialog.ts, in the get_credential_from_user component. The attack can be launched locally.

Risk Assessment

A local attacker could execute arbitrary commands in the context of the application, potentially leading to system takeover or data theft.

Recommendation

Update to a newer version if available and restrict local access to the system.

Other vulnerabilities in NocteDefensor LudusMCP

CVE-2026-19046Low
A security vulnerability has been detected in NocteDefensor LudusMCP up to 1.0.24. The impacted element is an unknown function of the file src/tools/ludusEnvironmentGuidesSearch.ts of the component ludus_environment_guides_search. Manipulation of the argument guide_name leads to path traversal. Local access is required to approach this attack.

Original NVD description (English source)

A weakness has been identified in NocteDefensor LudusMCP up to 1.0.24. The affected element is the function SecretDialog.showSecretDialog of the file src/utils/secretDialog.ts of the component get_credential_from_user. This manipulation of the argument Description causes command injection. It is possible to launch the attack on the local host. The project was informed of the problem early through an issue report but has not responded yet.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS