CVE-2026-19047
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
A command injection vulnerability was detected in the ludus_cli_execute component of NocteDefensor LudusMCP (up to version 1.0.24). The vulnerability affects the executeArbitraryCommand/executeCommand function in src/ludusMCP/cliWrapper.ts, where manipulation of the command/args arguments leads to command injection. The attack requires local access.
Risk Assessment
An individual with local access to the system can execute arbitrary commands in the context of the application, potentially leading to system compromise or data integrity violation. The project has not responded to the issue report.
Recommendation
It is recommended to restrict local access to the system and monitor user activities. Also, contact the project author for a fix or consider additional security measures such as command whitelisting.
Other vulnerabilities in LudusMCP
See all- CVE-2026-19367Medium
In NocteDefensor LudusMCP 1.0.24, a vulnerability was found in an unknown function of src/tools/rangeConfig.ts (read_range_config component). Manipulation of the Source argument leads to server-side request forgery (SSRF). The attack may be initiated remotely.
- CVE-2026-19366Medium
In NocteDefensor LudusMCP up to version 1.0.24, a vulnerability was found in an unknown function of src/tools/insertCredsRangeConfig.ts (insert_creds_range_config component). Manipulation of the configPath/outputPath arguments leads to path traversal. The attack is restricted to local execution.
Original NVD description (English source)
A vulnerability was detected in NocteDefensor LudusMCP up to 1.0.24. This affects the function executeArbitraryCommand/executeCommand of the file src/ludusMCP/cliWrapper.ts of the component ludus_cli_execute. Performing a manipulation of the argument command/args results in command injection. The attack needs to be approached locally. The project was informed of the problem early through an issue report but has not responded yet.