Threats affecting pkg:github/prolix-oc/Lumiverse

Lumiverse is a full-featured AI chat application. Prior to 0.9.7, consumeNonce() only checks that the module-level variable is set and unexpired. It does not validate any value from the incoming HTTP request or bind the nonce to the admin's session. If the admin's auth.api.signUpEmail() call fails before the before hook fires (e.g. BetterAuth rejects a duplicate email at the validation layer), the nonce is set but never consumed. Any POST /api/auth/sign-up/email request that arrives during the remaining window registers successfully regardless of who sent it. An attacker who can observe or predict when the admin is creating users (must be a dupplicate user) can race the 10-second window to register an unauthorized account. This vulnerability is fixed in 0.9.7.

CVE-2026-44444 is a critical OS command injection vulnerability in prolix-oc Lumiverse versions prior to 0.9.7. The issue arises because the Spindle extension build pipeline runs 'bun install' without the --ignore-scripts flag before performing a backend safety scan. This allows a malicious extension with lifecycle scripts (preinstall, postinstall, or prepare) in its package.json to execute arbitrary code on the host when an admin installs the extension. The vulnerability is fixed in version 0.9.7.

CVE-2026-44449 is a critical command injection vulnerability in prolix-oc's Lumiverse AI chat application versions prior to 0.9.7. The issue arises when the toSmbPath(fullPath) call fails and the fallback method concatenates an unvalidated basename directly into an smbclient command script. This allows an attacker to inject shell commands via special characters like ';' and '! cmd', leading to arbitrary command execution on the Lumiverse server. The vulnerability is fixed in version 0.9.7.

CVE-2026-44451 is a critical protection mechanism failure in the Lumiverse AI chat application prior to version 0.9.7. The vulnerability arises from the component override system that transpiles user-supplied TSX code and evaluates it in a sandbox intended to block dangerous globals. However, both the static source validator and runtime sandbox controls can be bypassed, allowing reconstruction of blocked identifiers and escape to the real window object via DOM references. Exploitation requires a victim to import a malicious theme pack and enable a component override, which then executes code in their authenticated session. This vulnerability is fixed in Lumiverse version 0.9.7.

Lumiverse is a full-featured AI chat application. Prior to 0.9.7, the MCP server creation endpoint validates the command field against an allowlist of binary names but forwards the args array to the child process without any validation. Every binary on the allowlist accepts an inline-code execution flag (-e for node/bun, -c for python3/deno), giving any logged-in user arbitrary OS-level code execution on the Lumiverse server. The route requires only requireAuth (not requireOwner). The server binds on all interfaces (::) and the host-header rebinding check is bypassed trivially by any HTTP client that sends Host: localhost:<port> directly, making this exploitable from any machine with network access to the server port. This vulnerability is fixed in 0.9.7.