CVE-2026-44451
A security flaw in the Lumiverse AI chat application allows attackers to bypass safety restrictions meant to isolate user-provided code. By using a specially crafted theme pack, an attacker can execute unauthorized code within a user's active session.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Users of the Lumiverse AI chat application prior to version 0.9.7.
Real-world impact
An attacker can gain control over a user's authenticated session by tricking them into importing a malicious theme pack and enabling a specific component override.
Why this severity
This is a critical vulnerability because it can be exploited remotely over the network without requiring special privileges, allowing an attacker to compromise the integrity and confidentiality of the user's session.
What to do about it
- 01Upgrade Lumiverse to version 0.9.7 or later.
NVD-referenced vendor advisory
Timeline
- May 26, 2026 · May 26, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 11d agoAdvisory updatedThe NVD record was last revised.
- Jul 25, 2026 · 11d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.