CVE-2026-44450 Lumiverse: RCE via MCP stdio argument injection
Logged-in users can execute arbitrary OS commands on the Lumiverse server via argument injection in MCP server creation, bypassing host-header checks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-44450?
CVE-2026-44450 is a critical command injection vulnerability in prolix-oc Lumiverse, published on 26 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Lumiverse is a full-featured AI chat application. Prior to 0.9.7, the MCP server creation endpoint validates the command field against an allowlist of binary names but forwards the args array to the child process without any validation. Every binary on the allowlist accepts an inline-code execution flag (-e for node/bun, -c for python3/deno), giving any logged-in user arbitrary OS-level code execution on the Lumiverse server. The route requires only requireAuth (not requireOwner). The server binds on all interfaces (::) and the host-header rebinding check is bypassed trivially by any HTTP client that sends Host: localhost:<port> directly, making this exploitable from any machine with network access to the server port. This vulnerability is fixed in 0.9.7.
Weakness: CWE-88
Which versions are affected by CVE-2026-44450?
How do I fix CVE-2026-44450?
No fix has been published for CVE-2026-44450 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-44450 being exploited?
There is no known exploitation of CVE-2026-44450 in the wild and no public exploit code.