Threats tagged 'ghsa-5ccg-4qw3-g338'

CVE-2026-19045 is a command injection vulnerability in NocteDefensor LudusMCP affecting versions up to 1.0.24. The flaw exists in the function SecretDialog.showSecretDialog within src/utils/secretDialog.ts, specifically in the get_credential_from_user component. This vulnerability allows an attacker with local access to manipulate the Description argument to execute arbitrary commands. The issue was reported early to the project, but no response or fix has been provided yet.