CVE-2026-44450

Name of the Vulnerable Software and Affected Versions Lumiverse versions prior to 0.9.7

Description An issue exists in the MCP server creation endpoint where the command field is validated against an allowlist of binary names, but the args array is forwarded to the child process without validation. Since binaries on the allowlist support inline-code execution flags (such as -e for node/bun and -c for python3/deno), any authenticated user can achieve arbitrary OS-level code execution on the server. The route only requires requireAuth and does not require requireOwner. Additionally, the server binds to all interfaces (::), and the host-header rebinding check can be bypassed by sending Host: localhost:<port>, allowing exploitation from any machine with network access to the server port.

Recommendations Update Lumiverse to version 0.9.7.