Lumiverse vulnerabilities
4 known vulnerabilities in Lumiverse from Prolix-oc. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.3 Critical severity
Lumiverse: Protection Mechanism Failure
Lumiverse is a full-featured AI chat application. Prior to 0.9.7, the component override system transpiles user-supplied TSX via Sucrase and evaluates it with new Function, shadowing dangerous globals (fetch, window, eval, etc.) with undefined. A static source
- 9.9 Critical severity
Lumiverse: Improper Neutralization of Argument Delimiters in a Command
Lumiverse is a full-featured AI chat application. Prior to 0.9.7, the MCP server creation endpoint validates the command field against an allowlist of binary names but forwards the args array to the child process without any validation. Every binary on the all
- 9.1 Critical severity
Lumiverse: Improper Neutralization of Argument Delimiters in a Command
Lumiverse is a full-featured AI chat application. Prior to 0.9.7, when the primary toSmbPath(fullPath) call throws, the method falls back to a dirname/basename split and only validates the directory prefix. The basename is concatenated directly into the smbcli
- 9.1 Critical severity
Lumiverse: Improper Neutralization of Special Elements used in an OS Command
Lumiverse is a full-featured AI chat application. Prior to 0.9.7, the Spindle extension build pipeline calls bun install without the --ignore-scripts flag before running the static backend safety scan (assertSafeBackendBundle). A malicious extension that ships