Is CVE-2026-19047 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-19047?

CVE-2026-19047 has a CVSS v3 severity of MEDIUM (5.3).

Back

CVE-2026-19047

Description

A vulnerability was detected in NocteDefensor LudusMCP up to 1.0.24. This affects the function executeArbitraryCommand/executeCommand of the file src/ludusMCP/cliWrapper.ts of the component ludus_cli_execute. Performing a manipulation of the argument command/args results in command injection. The attack needs to be approached locally. The project was informed of the problem early through an issue report but has not responded yet.