{"id":"CVE-2026-44444","aliases":["EUVD-2026-31981"],"status":"published","title":"Lumiverse: Spindle extension install runs untrusted lifecycle scripts before security scan","description":"Lumiverse is a full-featured AI chat application. Prior to 0.9.7, the Spindle extension build pipeline calls bun install without the --ignore-scripts flag before running the static backend safety scan (assertSafeBackendBundle). A malicious extension that ships a package.json with a preinstall, postinstall, or prepare lifecycle script achieves host-level code execution the moment an admin presses Install before any dist file is inspected. This vulnerability is fixed in 0.9.7.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.0037,"percentile":0.31111,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2026-05-26T20:01:03Z","modified":"2026-07-23T11:10:00Z","products":[{"vendor":"prolix-oc","product":"lumiverse"}],"references":[{"url":"https://github.com/prolix-oc/Lumiverse/security/advisories/GHSA-8x98-3wjp-pmj9","tags":["x_refsource_CONFIRM","exploit"]}],"sources":{"cve":[{"id":"CVE-2026-44444","title":"Lumiverse: Spindle extension install runs untrusted lifecycle scripts before security scan","description":"Lumiverse is a full-featured AI chat application. Prior to 0.9.7, the Spindle extension build pipeline calls bun install without the --ignore-scripts flag before running the static backend safety scan (assertSafeBackendBundle). A malicious extension that ships a package.json with a preinstall, postinstall, or prepare lifecycle script achieves host-level code execution the moment an admin presses Install before any dist file is inspected. This vulnerability is fixed in 0.9.7.","status":"published","published":"2026-05-26T20:01:03.872Z","modified":"2026-05-27T14:09:18.24Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T13:43:00.288193Z"}],"euvd":[{"id":"EUVD-2026-31981","description":"Lumiverse is a full-featured AI chat application. Prior to 0.9.7, the Spindle extension build pipeline calls bun install without the --ignore-scripts flag before running the static backend safety scan (assertSafeBackendBundle). A malicious extension that ships a package.json with a preinstall, postinstall, or prepare lifecycle script achieves host-level code execution the moment an admin presses Install before any dist file is inspected. This vulnerability is fixed in 0.9.7.","status":"published","published":"2026-05-26T20:01:03Z","modified":"2026-05-27T14:09:18Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:21:04.415835Z"}],"nvd":[{"id":"CVE-2026-44444","description":"Lumiverse is a full-featured AI chat application. Prior to 0.9.7, the Spindle extension build pipeline calls bun install without the --ignore-scripts flag before running the static backend safety scan (assertSafeBackendBundle). A malicious extension that ships a package.json with a preinstall, postinstall, or prepare lifecycle script achieves host-level code execution the moment an admin presses Install before any dist file is inspected. This vulnerability is fixed in 0.9.7.","status":"published","published":"2026-05-26T21:16:37.897Z","modified":"2026-07-23T11:10:00.12Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:12:20.511562Z"}]}}