« Volver al listado

CVE-2026-44449

Estado: AplazadaCrítica (9.1)—

Lumiverse is a full-featured AI chat application. Prior to 0.9.7, when the primary toSmbPath(fullPath) call throws, the method falls back to a dirname/basename split and only validates the directory prefix. The basename is concatenated directly into the smbclient -c script without validation. smbclient interprets ; as a subcommand separator and !cmd as a local-shell escape that runs cmd on the host. A path whose directory component is clean but whose basename contains "; !<cmd>; echo " achieves arbitrary command execution on the Lumiverse server. This vulnerability is fixed in 0.9.7.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Acceso remoto con PR:H (privilegios altos) a servicio SMB sin interacción. Inyección de comandos en smbclient mediante caracteres especiales (;, !) en basename sin validar permite ejecución arbitraria de comandos en el servidor Lumiverse.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementDisable or Remove Feature or ProgramVulnerability ScanningThreat Intelligence ProgramRestrict Web-Based ContentNetwork Segmentation

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Lumiverse — LumiverseAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-44449",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-44449",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-05-27T13:22:29.674327Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.1,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "prolix-oc",
          "product": "Lumiverse",
          "versions": [
            {
              "status": "affected",
              "version": "< 0.9.7"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-05-26T21:16:38.037",
  "references": [
    {
      "url": "https://github.com/prolix-oc/Lumiverse/security/advisories/GHSA-4v38-9hqq-7j53",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/prolix-oc/Lumiverse/security/advisories/GHSA-4v38-9hqq-7j53",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-88"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Lumiverse is a full-featured AI chat application. Prior to 0.9.7, when the primary toSmbPath(fullPath) call throws, the method falls back to a dirname/basename split and only validates the directory prefix. The basename is concatenated directly into the smbclient -c script without validation. smbclient interprets ; as a subcommand separator and !cmd as a local-shell escape that runs cmd on the host. A path whose directory component is clean but whose basename contains \"; !<cmd>; echo \" achieves arbitrary command execution on the Lumiverse server. This vulnerability is fixed in 0.9.7."
    },
    {
      "lang": "es",
      "value": "Lumiverse es una aplicación de chat de IA con todas las funciones. Antes de la versión 0.9.7, cuando la llamada principal a toSmbPath(fullPath) lanza una excepción, el método recurre a una división de dirname/basename y solo valida el prefijo del directorio. El basename se concatena directamente en el script de smbclient -c sin validación. smbclient interpreta ; como un separador de subcomandos y !cmd como un escape de shell local que ejecuta cmd en el host. Una ruta cuyo componente de directorio está limpio pero cuyo basename contiene ; !<cmd>; echo  logra la ejecución arbitraria de comandos en el servidor de Lumiverse. Esta vulnerabilidad está corregida en la versión 0.9.7."
    }
  ],
  "lastModified": "2026-07-24T11:10:00.170",
  "sourceIdentifier": "security-advisories@github.com"
}