Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-125358— Universal-modder before e88f687 Cross-Site WebSocket Command Execution via HostLink

Quick assessment

Affected
rehan-remade universal-modder
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在提交 e88f6876745427321eb755ebc98276063a962d8a 之前的 Universal-modder 版本中，其透传示例模组（passthrough example mods）的 HostLink 类存在 WebSocket 源（Origin）验证缺失的漏洞。该漏洞允许远程攻击者执行 Minecraft 命令。任何在玩家浏览器中打开的网页均可跨站点连接到未认证的本地回环 WebSocket，并发送由 WorldBridge.command() 以操作者（operator）权限执行的命令

CVSS 8.1 · High

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-125358

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Universal-modder before e88f687 Cross-Site WebSocket Command Execution via HostLink
Source: CVE Program / CVE List V5
Vulnerability Description
Universal-modder before commit e88f6876745427321eb755ebc98276063a962d8a contains a missing WebSocket Origin validation vulnerability in the HostLink class of its passthrough example mods that allows remote attackers to execute Minecraft commands. Any web page open in the player's browser can connect cross-site to the unauthenticated loopback WebSocket and send cmd messages that WorldBridge.command() runs with operator authority.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1385
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
rehan-remade universal-modder 0 ~ e88f6876745427321eb755ebc98276063a962d8a -

II. Public POCs for CVE-2026-125358

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-125358

请登录查看更多情报信息。

Other References for CVE-2026-125358 (4)

IV. Related Vulnerabilities

Same weakness: CWE-1385