Lumiverse, an AI chat application by prolix-oc, has an argument injection vulnerability (CWE-88) in its MCP server creation endpoint in versions before 0.9.7. Although the command field is validated against an allowlist of binary names, the arguments array is forwarded without validation. Since the allowed binaries accept inline-code execution flags (-e for node/bun, -c for python3/deno), a logged-in user can execute arbitrary OS commands on the server. The endpoint requires only basic authentication (requireAuth), not ownership, and the server binds on all interfaces (::). The host-header rebinding check is trivially bypassed by sending Host: localhost:<port>, enabling remote exploitation from any network-accessible machine. The vulnerability is addressed in Lumiverse 0.9.7.

An authenticated user can achieve arbitrary OS-level code execution on the Lumiverse server, potentially leading to full system compromise. The vulnerability allows command injection via unvalidated arguments passed to child processes. Because the server listens on all interfaces and the host-header check can be bypassed, exploitation can occur remotely from any machine with network access to the server port. The CVSS score is 9.9 (critical), indicating high impact on confidentiality, integrity, and availability.

This vulnerability is fixed in Lumiverse version 0.9.7. Users should upgrade to version 0.9.7 or later to remediate this issue. No other official remediation or temporary fixes are documented. Until upgrading, restrict network access to the server port to trusted hosts only to reduce exposure.