CVE-2026-19047

Name of the Vulnerable Software and Affected Versions NocteDefensor LudusMCP versions prior to 1.0.25

Description Command injection is possible through the manipulation of the command and args arguments. This issue resides within the executeArbitraryCommand() and executeCommand() functions located in the src/ludusMCP/cliWrapper.ts file of the ludus cli execute component. Exploitation requires local access to the system.

Recommendations As a temporary workaround, restrict the use of the executeArbitraryCommand() and executeCommand() functions until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.