CVE-2026-125358 · Other
NO FIX YET · SEE WHAT TO DO
Universal-modder's passthrough example mods accept WebSocket connections from any website without checking the origin. A web page open in a player's browser can send commands that the mod runs with operator authority in Minecraft.
first public Nov 6, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only setups running the Universal-modder passthrough example mods with the unauthenticated loopback WebSocket enabled are exposed. A browser on the same machine can reach the loopback socket, so a player's open web page is enough to trigger it. Projects that do not use these example mods can skip it.
Not affected if example-mods-not-used
Who cares minecraft, universal-modder, websocket
e88f6876745427321eb755ebc98276063a962d8ae88f6876745427321eb755ebc98276063a962d8a, per the patch linked in the sourcesUniversal-modder before commit e88f6876745427321eb755ebc98276063a962d8a contains a missing WebSocket Origin validation vulnerability in the HostLink class of its passthrough example mods that allows remote attackers to execute Minecraft commands. Any web page open in the player's browser can connect cross-site to the unauthenticated loopback WebSocket and send cmd messages that WorldBridge.command() runs with operator authority.
This page as .md ·
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.