CVE-2026-125358

8.1 HIGHpublic exploit available

Published 2026-11-10 · Updated 2026-11-10

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Universal-modder before commit e88f6876745427321eb755ebc98276063a962d8a contains a missing WebSocket Origin validation vulnerability in the HostLink class of its passthrough example mods that allows remote attackers to execute Minecraft commands. Any web page open in the player's browser can connect cross-site to the unauthenticated loopback WebSocket and send cmd messages that WorldBridge.command() runs with operator authority.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Weaknesses

CWE-1385

Public exploit & PoC references

https://github.com/rehan-remade/universal-modder/blob/edf45f6a26cb047886d9d7bcba392c328fc3d317/examples/minecraft-gta5-passthrough/mc/src/client/java/dev/rehan/passthrough/client/HostLink.java#L54-L72
https://github.com/rehan-remade/universal-modder/commit/e88f6876745427321eb755ebc98276063a962d8a
https://github.com/rehan-remade/universal-modder/security/advisories/GHSA-wjf6-3h6v-4gq9

All references

https://github.com/rehan-remade/universal-modder/blob/edf45f6a26cb047886d9d7bcba392c328fc3d317/examples/minecraft-gta5-passthrough/mc/src/client/java/dev/rehan/passthrough/client/HostLink.java#L54-L72
https://github.com/rehan-remade/universal-modder/commit/e88f6876745427321eb755ebc98276063a962d8a
https://github.com/rehan-remade/universal-modder/security/advisories/GHSA-wjf6-3h6v-4gq9
https://www.vulncheck.com/advisories/universal-modder-before-e88f687-cross-site-websocket-command-execution-via-hostlink

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2026-104380
UNSCOREDCVE-2026-107858PoC
MEDIUMCVE-2026-109330PoC
HIGHCVE-2026-112085PoC
MEDIUMCVE-2026-55463PoC
UNSCOREDCVE-2026-67405PoC
HIGHCVE-2026-77363PoC
UNSCOREDCVE-2026-85267

Related by shared AI tags and CWE weakness class. Browse the full archive.