PT-2026-68501

CVE-2026-19045

Published

2026-08-06

Updated

2026-08-06

Description by

CVSS 3.1

5.3

Medium

MetricsAV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions NocteDefensor LudusMCP versions prior to 1.0.25

Description Command injection is possible on the local host through the manipulation of the Description argument within the SecretDialog.showSecretDialog() function, located in the src/utils/secretDialog.ts file of the get credential from user component.

Recommendations As a temporary workaround, restrict the use of the SecretDialog.showSecretDialog() function until a patch is available.

Exploitability

Exploit

Fix

Impacts

Researchers

Gongyanyu

Vendors

Affected products

Weakness enumeration

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\'Injection\')

CWE-77: Improper Neutralization of Special Elements used in a Command (\'Command Injection\')