LudusMCP vulnerabilities
3 known CVE vulnerabilities in LudusMCP, translated and rated.
- CVE-2026-19367Medium
In NocteDefensor LudusMCP 1.0.24, a vulnerability was found in an unknown function of src/tools/rangeConfig.ts (read_range_config component). Manipulation of the Source argument leads to server-side request forgery (SSRF). The attack may be initiated remotely.
- CVE-2026-19366Medium
In NocteDefensor LudusMCP up to version 1.0.24, a vulnerability was found in an unknown function of src/tools/insertCredsRangeConfig.ts (insert_creds_range_config component). Manipulation of the configPath/outputPath arguments leads to path traversal. The attack is restricted to local execution.
- CVE-2026-19047Medium
A command injection vulnerability was detected in the ludus_cli_execute component of NocteDefensor LudusMCP (up to version 1.0.24). The vulnerability affects the executeArbitraryCommand/executeCommand function in src/ludusMCP/cliWrapper.ts, where manipulation of the command/args arguments leads to command injection. The attack requires local access.