CVE-2026-19367
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
In NocteDefensor LudusMCP 1.0.24, a vulnerability was found in an unknown function of src/tools/rangeConfig.ts (read_range_config component). Manipulation of the Source argument leads to server-side request forgery (SSRF). The attack may be initiated remotely.
Risk Assessment
SSRF vulnerability may allow an attacker to access internal network resources, potentially leading to confidentiality and integrity breaches.
Recommendation
It is recommended to validate and sanitize the Source argument and restrict access to the read_range_config function.
Original NVD description (English source)
A vulnerability has been found in NocteDefensor LudusMCP 1.0.24. Affected by this vulnerability is an unknown functionality of the file src/tools/rangeConfig.ts of the component read_range_config. The manipulation of the argument Source leads to server-side request forgery. The attack may be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.