CVE-2026-44444
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
Vulnerability in Lumiverse – the Spindle extension build pipeline runs `bun install` without `--ignore-scripts`, allowing a malicious extension to execute host-level code before security scanning. Fixed in version 0.9.7.
Risk Assessment
Risk of remote code execution – an admin installing an extension may unknowingly run malicious code, leading to system compromise.
Recommendation
Update Lumiverse to version 0.9.7 or later. Manually inspect extension contents before installation.
Original NVD description (English source)
Lumiverse is a full-featured AI chat application. Prior to 0.9.7, the Spindle extension build pipeline calls bun install without the --ignore-scripts flag before running the static backend safety scan (assertSafeBackendBundle). A malicious extension that ships a package.json with a preinstall, postinstall, or prepare lifecycle script achieves host-level code execution the moment an admin presses Install before any dist file is inspected. This vulnerability is fixed in 0.9.7.