CVE-2026-125358 Universal-modder before e88f687 Cross-Site WebSocket Command Execution via HostLink
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-125358?
CVE-2026-125358 is a high-severity vulnerability in rehan-remade universal-modder, published on 9 Nov 2026.
Official description
Universal-modder before commit e88f6876745427321eb755ebc98276063a962d8a contains a missing WebSocket Origin validation vulnerability in the HostLink class of its passthrough example mods that allows remote attackers to execute Minecraft commands. Any web page open in the player's browser can connect cross-site to the unauthenticated loopback WebSocket and send cmd messages that WorldBridge.command() runs with operator authority.
Weakness: CWE-1385
Which versions are affected by CVE-2026-125358?
How do I fix CVE-2026-125358?
No fix has been published for CVE-2026-125358 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-125358 being exploited?
There is no known exploitation of CVE-2026-125358 in the wild and no public exploit code.
Sources
Also known as GHSA-8qp9-fmqr-f85w, GHSA-wjf6-3h6v-4gq9.