PT-2026-68501 · Noctedefensor · Ludusmcp
CVSS v3.1
5.3
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
NocteDefensor LudusMCP versions prior to 1.0.25
Description
Command injection is possible on the local host through the manipulation of the
Description argument within the SecretDialog.showSecretDialog() function, located in the src/utils/secretDialog.ts file of the get credential from user component.Recommendations
As a temporary workaround, restrict the use of the
SecretDialog.showSecretDialog() function until a patch is available.Exploit
Fix
Special Elements Injection
Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Ludusmcp