What’s Vulnerable › Vulnerabilities

CVE-2026-44444: Lumiverse: Spindle extension install runs untrusted lifecycle scripts before security scan

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-26 · updated 2026-07-23
• Weakness: CWE-78

Description

Lumiverse is a full-featured AI chat application. Prior to 0.9.7, the Spindle extension build pipeline calls bun install without the --ignore-scripts flag before running the static backend safety scan (assertSafeBackendBundle). A malicious extension that ships a package.json with a preinstall, postinstall, or prepare lifecycle script achieves host-level code execution the moment an admin presses Install before any dist file is inspected. This vulnerability is fixed in 0.9.7.

Affected products

• prolix-oc Lumiverse: before 0.9.7

References

• https://github.com/prolix-oc/Lumiverse/security/advisories/GHSA-8x98-3wjp-pmj9
• https://github.com/prolix-oc/Lumiverse/security/advisories/GHSA-8x98-3wjp-pmj9

Get alerted when CVE-2026-44444 or the next vulnerability affects your stack