Lookup for vulnerabilities affecting packages.
| Vulnerability_id | VCID-49d8-4s95-akac |
|---|
| Summary | Lumiverse is a full-featured AI chat application. Prior to 0.9.7, when the primary toSmbPath(fullPath) call throws, the method falls back to a dirname/basename split and only validates the directory prefix. The basename is concatenated directly into the smbclient -c script without validation. smbclient interprets ; as a subcommand separator and !cmd as a local-shell escape that runs cmd on the host. A path whose directory component is clean but whose basename contains "; !<cmd>; echo " achieves arbitrary command execution on the Lumiverse server. This vulnerability is fixed in 0.9.7. |
|---|
| Aliases |
|
|---|
| Fixed_packages |
|
|---|
| Affected_packages |
|
|---|
| References |
| 0 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-44449 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00103 |
| scoring_system |
epss |
| scoring_elements |
0.27711 |
| published_at |
2026-06-11T12:55:00Z |
|
| 1 |
| value |
0.00103 |
| scoring_system |
epss |
| scoring_elements |
0.27912 |
| published_at |
2026-06-12T12:55:00Z |
|
| 2 |
| value |
0.00103 |
| scoring_system |
epss |
| scoring_elements |
0.27938 |
| published_at |
2026-06-13T12:55:00Z |
|
| 3 |
| value |
0.00103 |
| scoring_system |
epss |
| scoring_elements |
0.27928 |
| published_at |
2026-06-14T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-44449 |
|
| 1 |
|
|
|---|
| Weaknesses |
| 0 |
| cwe_id |
88 |
| name |
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') |
| description |
The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string. |
|
|
|---|
| Exploits |
|
|---|
| Severity_range_score | 9.1 - 9.1 |
|---|
| Exploitability | null |
|---|
| Weighted_severity | null |
|---|
| Risk_score | null |
|---|
| Resource_url | http://public2.vulnerablecode.io/vulnerabilities/VCID-49d8-4s95-akac |
|---|