CVE-2026-19045

MEDIUM

NocteDefensor LudusMCP get_credential_from_user secretDialog.ts SecretDialog.showSecretDialog command injection

Title source: cna
STIX 2.1

Description

A weakness has been identified in NocteDefensor LudusMCP up to 1.0.24. The affected element is the function SecretDialog.showSecretDialog of the file src/utils/secretDialog.ts of the component get_credential_from_user. This manipulation of the argument Description causes command injection. It is possible to launch the attack on the local host. The project was informed of the problem early through an issue report but has not responded yet.

References (7)

Core 7
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-386492 | NocteDefensor LudusMCP get_credential_from_user secretDialog.ts SecretDialog.showSecretDialog command injection
https://vuldb.com/vuln/386492
Signature, Permissions Required signature permissions-required
VDB-386492 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/386492/cti
Third Party Advisory third-party-advisory
CVE-2026-19045 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-19045
Third Party Advisory third-party-advisory
Submit #863833 | NocteDefensor LudusMCP 1.0.24 Command Injection
https://vuldb.com/submit/863833

Scores

CVSS v3 5.3
EPSS 0.0062
EPSS Percentile 46.6%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-74 CWE-77
Status published
Products (25)
NocteDefensor/LudusMCP 1.0.0
NocteDefensor/LudusMCP 1.0.1
NocteDefensor/LudusMCP 1.0.10
NocteDefensor/LudusMCP 1.0.11
NocteDefensor/LudusMCP 1.0.12
NocteDefensor/LudusMCP 1.0.13
NocteDefensor/LudusMCP 1.0.14
NocteDefensor/LudusMCP 1.0.15
NocteDefensor/LudusMCP 1.0.16
NocteDefensor/LudusMCP 1.0.17
... and 15 more
Published Aug 06, 2026
Tracked Since Aug 06, 2026