EUVD-2026-54087
GHSA-grhp-mc55-jxg8
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack vector and low privileges required to invoke the MCP tool; no scope change, with limited impact confined to the MCP server process.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was detected in NocteDefensor LudusMCP up to 1.0.24. This affects the function executeArbitraryCommand/executeCommand of the file src/ludusMCP/cliWrapper.ts of the component ludus_cli_execute. Performing a manipulation of the argument command/args results in command injection. The attack needs to be approached locally. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Command injection in NocteDefensor LudusMCP through version 1.0.24 allows a local attacker with low privileges to execute arbitrary OS commands by supplying crafted input to the command or args parameters of the executeArbitraryCommand and executeCommand functions in src/ludusMCP/cliWrapper.ts. A proof-of-concept exploit is publicly referenced (CVSS 4.0 E:P; GitHub issue at gongyaugugyy/public_exp), and the vendor has not responded to the coordinated disclosure. No active exploitation has been confirmed via CISA KEV, but the public POC lowers the exploitation barrier for any local attacker on systems running this MCP server.
Technical ContextAI
LudusMCP is a Model Context Protocol (MCP) server that wraps the Ludus cyber range CLI, enabling AI agents to invoke Ludus operations as MCP tools. The vulnerable component ludus_cli_execute exposes the executeArbitraryCommand and executeCommand functions in src/ludusMCP/cliWrapper.ts. CWE-77 (Improper Neutralization of Special Elements used in a Command) identifies the root cause: user-controlled values in the command or args parameters are passed to an OS command execution API without sanitization or parameterization, allowing shell metacharacters or command separators to be interpreted by the underlying shell. CPE cpe:2.3:a:noctedefensor:ludusmcp:*:*:*:*:*:*:*:* confirms the scope spans all releases of the product. Because MCP tool arguments can originate from AI agent calls, exploitation may be possible through prompt manipulation against any agent that has access to this tool.
RemediationAI
No vendor-released patch has been identified at time of analysis. The vendor has not responded to the coordinated disclosure filed via GitHub issue https://github.com/NocteDefensor/LudusMCP/issues/3. Monitor the upstream repository at https://github.com/NocteDefensor/LudusMCP/ for a patched release. As an immediate compensating control, restrict local system access to the host running LudusMCP to trusted users only, reducing the pool of principals who can invoke ludus_cli_execute; note that this does not eliminate the vulnerability but limits who can reach it. If the ludus_cli_execute tool is not operationally required, disabling it entirely removes the attack surface with no impact on other MCP tools. For deployments where the tool must remain active, implement an input validation wrapper that enforces an allowlist of permitted command values and rejects any argument containing shell metacharacters (;, &, |, ` `, $, etc.) before passing input to executeArbitraryCommand or executeCommand`; this workaround requires ongoing maintenance as the allowed command set evolves.
Path traversal in NocteDefensor LudusMCP up to version 1.0.24 allows a low-privileged local user to read files outside t
Command injection in NocteDefensor LudusMCP (all versions through 1.0.24) permits a local low-privileged attacker to exe
Path traversal in NocteDefensor LudusMCP (all versions up to 1.0.24) enables a locally authenticated low-privilege user
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today