CVE-2026-19047
Full vulnerability record from the local CVENow database.
Description
A vulnerability was detected in NocteDefensor LudusMCP up to 1.0.24. This affects the function executeArbitraryCommand/executeCommand of the file src/ludusMCP/cliWrapper.ts of the component ludus_cli_execute. Performing a manipulation of the argument command/args results in command injection. The attack needs to be approached locally. The project was informed of the problem early through an issue report but has not responded yet.
Severity
LOW
CVSS score
1.9
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2026-08-06 16:16:41.510000
Last modified
2026-10-23 21:10:00.157000
View original CVE JSON
{
"id": "CVE-2026-19047",
"sourceIdentifier": "[email protected]",
"published": "2026-08-06T16:16:41.510",
"lastModified": "2026-10-23T21:10:00.157",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in NocteDefensor LudusMCP up to 1.0.24. This affects the function executeArbitraryCommand/executeCommand of the file src/ludusMCP/cliWrapper.ts of the component ludus_cli_execute. Performing a manipulation of the argument command/args results in command injection. The attack needs to be approached locally. The project was informed of the problem early through an issue report but has not responded yet."
},
{
"lang": "es",
"value": "Se detectó una vulnerabilidad en NocteDefensor LudusMCP hasta la versión 1.0.24. Esto afecta a la función executeArbitraryCommand/executeCommand del archivo src/ludusMCP/cliWrapper.ts del componente ludus_cli_execute. Realizar una manipulación del argumento command/args resulta en inyección de comandos. El ataque debe abordarse localmente. Se informó al proyecto del problema con antelación a través de un informe de incidencias, pero aún no ha respondido."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "NocteDefensor",
"product": "LudusMCP",
"cpes": [
"cpe:2.3:a:noctedefensor:ludusmcp:*:*:*:*:*:*:*:*"
],
"modules": [
"ludus_cli_execute"
],
"versions": [
{
"version": "1.0.0",
"status": "affected"
},
{
"version": "1.0.1",
"status": "affected"
},
{
"version": "1.0.2",
"status": "affected"
},
{
"version": "1.0.3",
"status": "affected"
},
{
"version": "1.0.4",
"status": "affected"
},
{
"version": "1.0.5",
"status": "affected"
},
{
"version": "1.0.6",
"status": "affected"
},
{
"version": "1.0.7",
"status": "affected"
},
{
"version": "1.0.8",
"status": "affected"
},
{
"version": "1.0.9",
"status": "affected"
},
{
"version": "1.0.10",
"status": "affected"
},
{
"version": "1.0.11",
"status": "affected"
},
{
"version": "1.0.12",
"status": "affected"
},
{
"version": "1.0.13",
"status": "affected"
},
{
"version": "1.0.14",
"status": "affected"
},
{
"version": "1.0.15",
"status": "affected"
},
{
"version": "1.0.16",
"status": "affected"
},
{
"version": "1.0.17",
"status": "affected"
},
{
"version": "1.0.18",
"status": "affected"
},
{
"version": "1.0.19",
"status": "affected"
},
{
"version": "1.0.20",
"status": "affected"
},
{
"version": "1.0.21",
"status": "affected"
},
{
"version": "1.0.22",
"status": "affected"
},
{
"version": "1.0.23",
"status": "affected"
},
{
"version": "1.0.24",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 1.9,
"baseSeverity": "LOW",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "PROOF_OF_CONCEPT",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 1.8,
"impactScore": 3.4
}
],
"cvssMetricV2": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P",
"baseScore": 4.3,
"accessVector": "LOCAL",
"accessComplexity": "LOW",
"authentication": "SINGLE",
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"availabilityImpact": "PARTIAL"
},
"baseSeverity": "MEDIUM",
"exploitabilityScore": 3.1,
"impactScore": 6.4,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-08T02:04:49.106070Z",
"id": "CVE-2026-19047",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-74"
},
{
"lang": "en",
"value": "CWE-77"
}
]
}
],
"references": [
{
"url": "https://github.com/NocteDefensor/LudusMCP/",
"source": "[email protected]"
},
{
"url": "https://github.com/NocteDefensor/LudusMCP/issues/3",
"source": "[email protected]"
},
{
"url": "https://github.com/gongyanyugyy/public_exp/issues/2",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/cve/CVE-2026-19047",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/submit/863835",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/386494",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/386494/cti",
"source": "[email protected]"
}
]
}