CVE-2026-125358

Name of the Vulnerable Software and Affected Versions Universal-modder versions prior to commit e88f6876745427321eb755ebc98276063a962d8a

Description Missing WebSocket Origin validation in the HostLink class of passthrough example mods allows remote attackers to execute Minecraft commands. A malicious web page open in the player's browser can establish a cross-site connection to the unauthenticated loopback WebSocket and send cmd messages, which are then executed with operator authority via the WorldBridge.command() function.

Recommendations Update Universal-modder to commit e88f6876745427321eb755ebc98276063a962d8a or later.