CVE-2026-44450
Lumiverse AI chat application versions before 0.9.7 allow logged‑in users to run arbitrary code on the server by passing unvalidated arguments to allowed binaries. The flaw can be exploited over the network and gives attackers full control of the host.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Lumiverse AI chat application, any version earlier than 0.9.7, for users who are logged in and have network access to the server.
Real-world impact
An attacker can execute arbitrary commands on the Lumiverse server, potentially taking over the machine, stealing data, or using it for further attacks.
Why this severity
The CVSS score of 9.9 reflects that the vulnerability can be exploited remotely with low effort, requires only that the user be authenticated, and gives the attacker full confidentiality, integrity, and availability compromise. The scope change indicates that the flaw can affect other components beyond the vulnerable one.
What to do about it
- 01Check the current Lumiverse version running on the server.
- 02Download the latest release (0.9.7 or newer) from the official source.
- 03Install or upgrade the application to the new version.
- 04Restart the Lumiverse service to apply the update.
- 05Verify that the server is no longer listening on all interfaces or that host‑header checks are enforced.
NVD-referenced vendor advisory
Timeline
- May 26, 2026 · May 26, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 11d agoAdvisory updatedThe NVD record was last revised.
- Jul 25, 2026 · 10d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.