Universal-modder version 0 contains a vulnerability due to missing WebSocket Origin validation in the HostLink class of its passthrough example mods. This flaw allows remote attackers to connect cross-site to an unauthenticated loopback WebSocket and send command messages that are executed with operator privileges in Minecraft. The vulnerability is fixed in commit e88f6876745427321eb755ebc98276063a962d8a.