Search

Find a vulnerability

Search criteria

    2 vulnerabilities by rehan-remade

    CVE-2026-125358 (GCVE-0-2026-125358)

    Vulnerability from nvd – Published: 2026-11-09 23:27 – Updated: 2026-11-09 23:27
    VLAI
    Title
    Universal-modder before e88f687 Cross-Site WebSocket Command Execution via HostLink
    Summary
    Universal-modder before commit e88f6876745427321eb755ebc98276063a962d8a contains a missing WebSocket Origin validation vulnerability in the HostLink class of its passthrough example mods that allows remote attackers to execute Minecraft commands. Any web page open in the player's browser can connect cross-site to the unauthenticated loopback WebSocket and send cmd messages that WorldBridge.command() runs with operator authority.
    Severity
    7.2 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
    8.1 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
    CWE
    • CWE-1385 - Missing Origin Validation in WebSockets
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 7784 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    rehan-remade universal-modder Affected: 0 , < e88f6876745427321eb755ebc98276063a962d8a (git)
    		Create a notification for this product.
    Date Public
    2026-11-06 00:00
    Credits
    George Chen
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "universal-modder",
          "repo": "https://github.com/rehan-remade/universal-modder",
          "vendor": "rehan-remade",
          "versions": [
            {
              "lessThan": "e88f6876745427321eb755ebc98276063a962d8a",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "George Chen"
        }
      ],
      "datePublic": "2026-11-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Universal-modder before commit e88f6876745427321eb755ebc98276063a962d8a contains a missing WebSocket Origin validation vulnerability in the HostLink class of its passthrough example mods that allows remote attackers to execute Minecraft commands. Any web page open in the player\u0027s browser can connect cross-site to the unauthenticated loopback WebSocket and send cmd messages that WorldBridge.command() runs with operator authority."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1385",
              "description": "Missing Origin Validation in WebSockets",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T23:27:32.693Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-wjf6-3h6v-4gq9)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/rehan-remade/universal-modder/security/advisories/GHSA-wjf6-3h6v-4gq9"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/rehan-remade/universal-modder/commit/e88f6876745427321eb755ebc98276063a962d8a"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/rehan-remade/universal-modder/blob/edf45f6a26cb047886d9d7bcba392c328fc3d317/examples/minecraft-gta5-passthrough/mc/src/client/java/dev/rehan/passthrough/client/HostLink.java#L54-L72"
        },
        {
          "name": "VulnCheck Advisory: Universal-modder before e88f687 Cross-Site WebSocket Command Execution via HostLink",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/universal-modder-before-e88f687-cross-site-websocket-command-execution-via-hostlink"
        }
      ],
      "title": "Universal-modder before e88f687 Cross-Site WebSocket Command Execution via HostLink",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-125358",
    "datePublished": "2026-11-09T23:27:32.693Z",
    "dateReserved": "2026-11-09T22:02:59.524Z",
    "dateUpdated": "2026-11-09T23:27:32.693Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-125358 (GCVE-0-2026-125358)

    Vulnerability from cvelistv5 – Published: 2026-11-09 23:27 – Updated: 2026-11-09 23:27
    VLAI
    Title
    Universal-modder before e88f687 Cross-Site WebSocket Command Execution via HostLink
    Summary
    Universal-modder before commit e88f6876745427321eb755ebc98276063a962d8a contains a missing WebSocket Origin validation vulnerability in the HostLink class of its passthrough example mods that allows remote attackers to execute Minecraft commands. Any web page open in the player's browser can connect cross-site to the unauthenticated loopback WebSocket and send cmd messages that WorldBridge.command() runs with operator authority.
    Severity
    7.2 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
    8.1 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
    CWE
    • CWE-1385 - Missing Origin Validation in WebSockets
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 7784 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    rehan-remade universal-modder Affected: 0 , < e88f6876745427321eb755ebc98276063a962d8a (git)
    		Create a notification for this product.
    Date Public
    2026-11-06 00:00
    Credits
    George Chen
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "universal-modder",
          "repo": "https://github.com/rehan-remade/universal-modder",
          "vendor": "rehan-remade",
          "versions": [
            {
              "lessThan": "e88f6876745427321eb755ebc98276063a962d8a",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "George Chen"
        }
      ],
      "datePublic": "2026-11-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Universal-modder before commit e88f6876745427321eb755ebc98276063a962d8a contains a missing WebSocket Origin validation vulnerability in the HostLink class of its passthrough example mods that allows remote attackers to execute Minecraft commands. Any web page open in the player\u0027s browser can connect cross-site to the unauthenticated loopback WebSocket and send cmd messages that WorldBridge.command() runs with operator authority."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1385",
              "description": "Missing Origin Validation in WebSockets",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T23:27:32.693Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-wjf6-3h6v-4gq9)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/rehan-remade/universal-modder/security/advisories/GHSA-wjf6-3h6v-4gq9"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/rehan-remade/universal-modder/commit/e88f6876745427321eb755ebc98276063a962d8a"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/rehan-remade/universal-modder/blob/edf45f6a26cb047886d9d7bcba392c328fc3d317/examples/minecraft-gta5-passthrough/mc/src/client/java/dev/rehan/passthrough/client/HostLink.java#L54-L72"
        },
        {
          "name": "VulnCheck Advisory: Universal-modder before e88f687 Cross-Site WebSocket Command Execution via HostLink",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/universal-modder-before-e88f687-cross-site-websocket-command-execution-via-hostlink"
        }
      ],
      "title": "Universal-modder before e88f687 Cross-Site WebSocket Command Execution via HostLink",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-125358",
    "datePublished": "2026-11-09T23:27:32.693Z",
    "dateReserved": "2026-11-09T22:02:59.524Z",
    "dateUpdated": "2026-11-09T23:27:32.693Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}