CVE-2026-19045
Full vulnerability record from the local CVENow database.
Description
A weakness has been identified in NocteDefensor LudusMCP up to 1.0.24. The affected element is the function SecretDialog.showSecretDialog of the file src/utils/secretDialog.ts of the component get_credential_from_user. This manipulation of the argument Description causes command injection. It is possible to launch the attack on the local host. The project was informed of the problem early through an issue report but has not responded yet.
Severity
LOW
CVSS score
1.9
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2026-08-06 15:16:49.550000
Last modified
2026-10-23 21:10:00.157000
View original CVE JSON
{
"id": "CVE-2026-19045",
"sourceIdentifier": "[email protected]",
"published": "2026-08-06T15:16:49.550",
"lastModified": "2026-10-23T21:10:00.157",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in NocteDefensor LudusMCP up to 1.0.24. The affected element is the function SecretDialog.showSecretDialog of the file src/utils/secretDialog.ts of the component get_credential_from_user. This manipulation of the argument Description causes command injection. It is possible to launch the attack on the local host. The project was informed of the problem early through an issue report but has not responded yet."
},
{
"lang": "es",
"value": "Se ha identificado una debilidad en NocteDefensor LudusMCP hasta la versión 1.0.24. El elemento afectado es la función SecretDialog.showSecretDialog del archivo src/utils/secretDialog.ts del componente get_credential_from_user. Esta manipulación del argumento Description causa inyección de comandos. Es posible lanzar el ataque en el host local. El proyecto fue informado del problema tempranamente a través de un informe de incidencias pero aún no ha respondido."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "NocteDefensor",
"product": "LudusMCP",
"cpes": [
"cpe:2.3:a:noctedefensor:ludusmcp:*:*:*:*:*:*:*:*"
],
"modules": [
"get_credential_from_user"
],
"versions": [
{
"version": "1.0.0",
"status": "affected"
},
{
"version": "1.0.1",
"status": "affected"
},
{
"version": "1.0.2",
"status": "affected"
},
{
"version": "1.0.3",
"status": "affected"
},
{
"version": "1.0.4",
"status": "affected"
},
{
"version": "1.0.5",
"status": "affected"
},
{
"version": "1.0.6",
"status": "affected"
},
{
"version": "1.0.7",
"status": "affected"
},
{
"version": "1.0.8",
"status": "affected"
},
{
"version": "1.0.9",
"status": "affected"
},
{
"version": "1.0.10",
"status": "affected"
},
{
"version": "1.0.11",
"status": "affected"
},
{
"version": "1.0.12",
"status": "affected"
},
{
"version": "1.0.13",
"status": "affected"
},
{
"version": "1.0.14",
"status": "affected"
},
{
"version": "1.0.15",
"status": "affected"
},
{
"version": "1.0.16",
"status": "affected"
},
{
"version": "1.0.17",
"status": "affected"
},
{
"version": "1.0.18",
"status": "affected"
},
{
"version": "1.0.19",
"status": "affected"
},
{
"version": "1.0.20",
"status": "affected"
},
{
"version": "1.0.21",
"status": "affected"
},
{
"version": "1.0.22",
"status": "affected"
},
{
"version": "1.0.23",
"status": "affected"
},
{
"version": "1.0.24",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 1.9,
"baseSeverity": "LOW",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "PROOF_OF_CONCEPT",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 1.8,
"impactScore": 3.4
}
],
"cvssMetricV2": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P",
"baseScore": 4.3,
"accessVector": "LOCAL",
"accessComplexity": "LOW",
"authentication": "SINGLE",
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"availabilityImpact": "PARTIAL"
},
"baseSeverity": "MEDIUM",
"exploitabilityScore": 3.1,
"impactScore": 6.4,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-06T16:02:36.308901Z",
"id": "CVE-2026-19045",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-74"
},
{
"lang": "en",
"value": "CWE-77"
}
]
}
],
"references": [
{
"url": "https://github.com/NocteDefensor/LudusMCP/",
"source": "[email protected]"
},
{
"url": "https://github.com/NocteDefensor/LudusMCP/issues/2",
"source": "[email protected]"
},
{
"url": "https://github.com/gongyanyugyy/public_exp/issues/1",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/cve/CVE-2026-19045",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/submit/863833",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/386492",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/386492/cti",
"source": "[email protected]"
},
{
"url": "https://github.com/NocteDefensor/LudusMCP/issues/2",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
},
{
"url": "https://github.com/gongyanyugyy/public_exp/issues/1",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
]
}