What’s Vulnerable › Vulnerabilities

CVE-2026-19045: NocteDefensor LudusMCP get_credential_from_user secretDialog.ts SecretDialog.showSecretDialog command injection

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-06 · updated 2026-10-23
• Weakness: CWE-74

Description

A weakness has been identified in NocteDefensor LudusMCP up to 1.0.24. The affected element is the function SecretDialog.showSecretDialog of the file src/utils/secretDialog.ts of the component get_credential_from_user. This manipulation of the argument Description causes command injection. It is possible to launch the attack on the local host. The project was informed of the problem early through an issue report but has not responded yet.

Affected products

• NocteDefensor LudusMCP: 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5 (+19)

References

• https://github.com/NocteDefensor/LudusMCP/
• https://github.com/NocteDefensor/LudusMCP/issues/2
• https://github.com/gongyanyugyy/public_exp/issues/1
• https://vuldb.com/cve/CVE-2026-19045
• https://vuldb.com/submit/863833
• https://vuldb.com/vuln/386492
• https://vuldb.com/vuln/386492/cti
• https://github.com/NocteDefensor/LudusMCP/issues/2
• https://github.com/gongyanyugyy/public_exp/issues/1

Get alerted when CVE-2026-19045 or the next vulnerability affects your stack