CyberRota Analysis
AI-GeneratedA command injection vulnerability exists in the SecretDialog.showSecretDialog function of NocteDefensor LudusMCP versions up to 1.0.24, allowing attackers to manipulate the argument Description to execute arbitrary commands on the local host. This weakness poses a medium severity risk, particularly for organizations using this software, as it could lead to unauthorized access or data compromise. Users and administrators of affected versions should prioritize applying patches or implementing mitigations to safeguard their systems.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A weakness has been identified in NocteDefensor LudusMCP up to 1.0.24. The affected element is the function SecretDialog.showSecretDialog of the file src/utils/secretDialog.ts of the component get_credential_from_user. This manipulation of the argument Description causes command injection. It is possible to launch the attack on the local host. The project was informed of the problem early through an issue report but has not responded yet.