CVE-2026-2544
HIGHyued-fe LuLu UI <3.0.0 - Command Injection
Title source: llmDescription
A security flaw has been discovered in yued-fe LuLu UI up to 3.0.0. This issue affects the function child_process.exec of the file run.js. The manipulation results in os command injection. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
CVSS v3
7.3
EPSS
0.0214
EPSS Percentile
84.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Classification
CWE
CWE-77
CWE-78
Status
draft
Timeline
Published
Feb 16, 2026
Tracked Since
Feb 18, 2026