Threats affecting pkg:github/noctedefensor/LudusMCP

CVE-2026-19367 is a server-side request forgery (SSRF) vulnerability found in NocteDefensor LudusMCP version 1.0.24. It involves manipulation of the Source argument in the file src/tools/rangeConfig.ts within the read_range_config component. The vulnerability can be exploited remotely. The vendor has been informed but has not yet responded or issued a fix. The CVSS 4.0 base score is 5.3, indicating medium severity.

A flaw has been found in NocteDefensor LudusMCP up to 1.0.24. Affected is an unknown function of the file src/tools/insertCredsRangeConfig.ts of the component insert_creds_range_config. Executing a manipulation of the argument configPath/outputPath can lead to path traversal. The attack is restricted to local execution. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was detected in NocteDefensor LudusMCP up to 1.0.24. This affects the function executeArbitraryCommand/executeCommand of the file src/ludusMCP/cliWrapper.ts of the component ludus_cli_execute. Performing a manipulation of the argument command/args results in command injection. The attack needs to be approached locally. The project was informed of the problem early through an issue report but has not responded yet.

CVE-2026-19046 is a path traversal vulnerability in NocteDefensor LudusMCP affecting versions up to 1.0.24. The flaw exists in an unknown function within the src/tools/ludusEnvironmentGuidesSearch.ts file, specifically in the ludus_environment_guides_search component. Exploitation requires local access and involves manipulation of the guide_name argument to perform path traversal. The vendor has not yet responded or issued a fix for this vulnerability.

CVE-2026-19045 is a command injection vulnerability in NocteDefensor LudusMCP affecting versions up to 1.0.24. The flaw exists in the function SecretDialog.showSecretDialog within src/utils/secretDialog.ts, specifically in the get_credential_from_user component. This vulnerability allows an attacker with local access to manipulate the Description argument to execute arbitrary commands. The issue was reported early to the project, but no response or fix has been provided yet.