{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-125358", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-11-09T22:02:59.524Z", "datePublished": "2026-11-09T23:27:32.693Z", "dateUpdated": "2026-11-09T23:27:32.693Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-09T23:27:32.693Z"}, "datePublic": "2026-11-06T00:00:00.000Z", "title": "Universal-modder before e88f687 Cross-Site WebSocket Command Execution via HostLink", "descriptions": [{"lang": "en", "value": "Universal-modder before commit e88f6876745427321eb755ebc98276063a962d8a contains a missing WebSocket Origin validation vulnerability in the HostLink class of its passthrough example mods that allows remote attackers to execute Minecraft commands. Any web page open in the player's browser can connect cross-site to the unauthenticated loopback WebSocket and send cmd messages that WorldBridge.command() runs with operator authority."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Missing Origin Validation in WebSockets", "cweId": "CWE-1385", "type": "CWE"}]}], "affected": [{"vendor": "rehan-remade", "product": "universal-modder", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "e88f6876745427321eb755ebc98276063a962d8a", "status": "affected", "versionType": "git"}], "repo": "https://github.com/rehan-remade/universal-modder"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.2, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/rehan-remade/universal-modder/security/advisories/GHSA-wjf6-3h6v-4gq9", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-wjf6-3h6v-4gq9)"}, {"url": "https://github.com/rehan-remade/universal-modder/commit/e88f6876745427321eb755ebc98276063a962d8a", "tags": ["patch"]}, {"url": "https://github.com/rehan-remade/universal-modder/blob/edf45f6a26cb047886d9d7bcba392c328fc3d317/examples/minecraft-gta5-passthrough/mc/src/client/java/dev/rehan/passthrough/client/HostLink.java#L54-L72", "tags": ["technical-description"]}, {"name": "VulnCheck Advisory: Universal-modder before e88f687 Cross-Site WebSocket Command Execution via HostLink", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/universal-modder-before-e88f687-cross-site-websocket-command-execution-via-hostlink"}], "credits": [{"lang": "en", "value": "George Chen", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "universal-modder", "repo": "https://github.com/rehan-remade/universal-modder", "vendor": "rehan-remade", "versions": [{"lessThan": "e88f6876745427321eb755ebc98276063a962d8a", "status": "affected", "version": "0", "versionType": "git"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Universal-modder before commit e88f6876745427321eb755ebc98276063a962d8a contains a missing WebSocket Origin validation vulnerability in the HostLink class of its passthrough example mods that allows remote attackers to execute Minecraft commands. Any web page open in the player's browser can connect cross-site to the unauthenticated loopback WebSocket and send cmd messages that WorldBridge.command() runs with operator authority."}], "id": "CVE-2026-125358", "lastModified": "2026-11-10T00:17:07.180", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "disclosure@vulncheck.com", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}]}, "published": "2026-11-10T00:17:07.180", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/rehan-remade/universal-modder/blob/edf45f6a26cb047886d9d7bcba392c328fc3d317/examples/minecraft-gta5-passthrough/mc/src/client/java/dev/rehan/passthrough/client/HostLink.java#L54-L72"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/rehan-remade/universal-modder/commit/e88f6876745427321eb755ebc98276063a962d8a"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/rehan-remade/universal-modder/security/advisories/GHSA-wjf6-3h6v-4gq9"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/universal-modder-before-e88f687-cross-site-websocket-command-execution-via-hostlink"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1385"}], "source": "disclosure@vulncheck.com", "type": "Primary"}]}

{}