LudusMCP EUVD-2026-53915

Q: What is the CVSS score of EUVD-2026-53915?

EUVD-2026-53915 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

| CVE-2026-19045 LOW

Command Injection (CWE-77)

2026-08-06 VulDB

GHSA-5ccg-4qw3-g338

Command Injection Ludusmcp Noctedefensor

1.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

1.9 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Local-only vector with low privileges required; limited and symmetric CIA impact; no scope change per CVSS 4.0 SC:N/SI:N/SA:N.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 16:16 vuln.today

Severity Changed

Aug 06, 2026 - 15:22 NVD

MEDIUM LOW

CVSS changed

Aug 06, 2026 - 15:22 NVD

4.8 (MEDIUM) 1.9 (LOW)

DescriptionCVE.org

A weakness has been identified in NocteDefensor LudusMCP up to 1.0.24. The affected element is the function SecretDialog.showSecretDialog of the file src/utils/secretDialog.ts of the component get_credential_from_user. This manipulation of the argument Description causes command injection. It is possible to launch the attack on the local host. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Command injection in NocteDefensor LudusMCP (all versions through 1.0.24) permits a local low-privileged attacker to execute arbitrary OS commands by manipulating the Description argument passed to SecretDialog.showSecretDialog within the get_credential_from_user component (src/utils/secretDialog.ts). Exploitation is constrained to the local host and requires at minimum low-privilege OS credentials, consistent with the CVSS 4.0 AV:L/PR:L metrics and a final score of 1.9. A proof-of-concept exploit has been publicly posted (CVSS 4.0 E:P; GitHub issue at gongyaugugyy/public_exp), but no vendor patch has been released - the project has not responded to the coordinated disclosure as of this analysis.

Technical ContextAI

LudusMCP is a Model Context Protocol (MCP) server tool published by NocteDefensor. The vulnerable code path resides in src/utils/secretDialog.ts, within the SecretDialog.showSecretDialog function of the get_credential_from_user component. CWE-77 (Improper Neutralization of Special Elements used in a Command) identifies the root cause: the Description argument accepted by this dialog is incorporated into a system command invocation without proper sanitization or quoting, allowing injection of shell metacharacters (semicolons, backticks, pipe characters, etc.) that redirect or augment command execution. All releases from 1.0.0 through 1.0.24 are confirmed affected per CPE cpe:2.3:a:noctedefensor:ludusmcp:*:*:*:*:*:*:*:* and the 25-version enumeration in EUVD-2026-53915. The component name - get_credential_from_user - indicates this dialog is responsible for obtaining sensitive credential input, making it a particularly sensitive injection surface.

RemediationAI

No vendor-released patch has been identified at time of analysis. The project was notified via GitHub issue (https://github.com/NocteDefensor/LudusMCP/issues/2) but has not responded, and no fixed release version exists to cite. Until a patch is available, administrators should restrict LudusMCP deployments to isolated environments accessible only to fully trusted users, eliminating the local low-privilege access prerequisite for exploitation. If the get_credential_from_user dialog functionality is not strictly necessary, disabling or removing the SecretDialog component from the deployment reduces attack surface, though this may break credential-handling workflows. Organizations with elevated security requirements should consider suspending use of LudusMCP entirely until the vendor responds and issues a fix. Monitor the GitHub repository at https://github.com/NocteDefensor/LudusMCP/ and the VulDB entry at https://vuldb.com/cve/CVE-2026-19045 for patch availability.