{"id":"CVE-2026-125358","kind":"vulnerability","aliases":["CVE-2026-125358"],"related":[],"title":"Universal-modder: missing WebSocket origin check lets web pages run Minecraft commands","description":"Universal-modder before commit e88f6876745427321eb755ebc98276063a962d8a contains a missing WebSocket Origin validation vulnerability in the HostLink class of its passthrough example mods that allows remote attackers to execute Minecraft commands. Any web page open in the player's browser can connect cross-site to the unauthenticated loopback WebSocket and send cmd messages that WorldBridge.command() runs with operator authority.","summary":"Universal-modder's passthrough example mods accept WebSocket connections from any website without checking the origin. A web page open in a player's browser can send commands that the mod runs with operator authority in Minecraft.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["minecraft","other","universal-modder","websocket"],"not_affected_if":["example-mods-not-used"],"how_to_check":"- Check whether the project's example mods (the HostLink class in the passthrough example) are installed or used from a commit before `e88f6876745427321eb755ebc98276063a962d8a`","fix":"- Move to a commit at or after `e88f6876745427321eb755ebc98276063a962d8a`, per the patch linked in the sources","status":"open","published_at":"2026-11-10T00:17:07+00:00","first_seen_at":"2026-11-10T00:28:41+00:00","triaged_at":"2026-11-10T00:29:58+00:00","updated_at":"2026-11-10T00:29:58+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-10T00:29:58Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a commit at or after `e88f6876745427321eb755ebc98276063a962d8a`, per the patch linked in the sources","reach":"local","title":"Universal-modder: missing WebSocket origin check lets web pages run Minecraft commands","impact":"high","summary":"Universal-modder's passthrough example mods accept WebSocket connections from any website without checking the origin. A web page open in a player's browser can send commands that the mod runs with operator authority in Minecraft.","audience":"developers","category":"other","nicknames":[],"who_cares":["minecraft","universal-modder","websocket"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Remote web pages run Minecraft commands with operator authority on the player's game","analyst_note":"Confirm affected version range and whether the fix is a specific release; the sources only give a commit hash via the patch link.","how_to_check":"- Check whether the project's example mods (the HostLink class in the passthrough example) are installed or used from a commit before `e88f6876745427321eb755ebc98276063a962d8a`\n- unknown otherwise","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["example-mods-not-used"],"who_is_affected":"Only setups running the Universal-modder passthrough example mods with the unauthenticated loopback WebSocket enabled are exposed. A browser on the same machine can reach the loopback socket, so a player's open web page is enough to trigger it. Projects that do not use these example mods can skip it.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000756,"input_tokens":4657,"output_tokens":580,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-125358':16A,19A '-2026':15A,18A 'accept':33B 'allow':87C 'attack':89C 'author':61B,122C 'browser':51B,102C 'check':7A,40B 'class':80C 'cmd':115C 'command':13A,54B,93C 'commit':68C 'connect':35B,104C 'contain':70C 'cross':106C 'cross-sit':105C 'cve':14A,17A 'e88f6876745427321eb755ebc98276063a962d8a':69C 'exampl':31B,84C 'execut':91C 'hostlink':79C 'let':8A 'loopback':111C 'messag':116C 'minecraft':12A,20B,63B,92C 'miss':4A,72C 'mod':32B,57B,85C 'modder':3A,24B,28B,66C 'open':46B,97C 'oper':60B,121C 'origin':6A,42B,74C 'page':10A,45B,96C 'passthrough':30B,83C 'player':49B,100C 'remot':88C 'run':11A,58B,119C 'send':53B,114C 'site':107C 'unauthent':110C 'univers':2A,23B,27B,65C 'universal-modd':1A,22B,26B,64C 'valid':75C 'vulner':76C 'web':9A,44B,95C 'websit':38B 'websocket':5A,25B,34B,73C,112C 'without':39B 'worldbridge.command':118C","nicknames":[],"mitigations":[],"who_affected":"Only setups running the Universal-modder passthrough example mods with the unauthenticated loopback WebSocket enabled are exposed. A browser on the same machine can reach the loopback socket, so a player's open web page is enough to trigger it. Projects that do not use these example mods can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","minecraft","other","universalmodder","websocket"],"campaign_type":null,"search_a":"'-125358':16A,19A '-2026':15A,18A 'check':7A 'command':13A 'cve':14A,17A 'let':8A 'minecraft':12A 'miss':4A 'modder':3A 'origin':6A 'page':10A 'run':11A 'univers':2A 'universal-modd':1A 'web':9A 'websocket':5A","search_b":"'accept':33B 'author':61B 'browser':51B 'check':40B 'command':54B 'connect':35B 'exampl':31B 'minecraft':20B,63B 'mod':32B,57B 'modder':24B,28B 'open':46B 'oper':60B 'origin':42B 'page':45B 'passthrough':30B 'player':49B 'run':58B 'send':53B 'univers':23B,27B 'universal-modd':22B,26B 'web':44B 'websit':38B 'websocket':25B,34B 'without':39B","search_c":"'allow':87C 'attack':89C 'author':122C 'browser':102C 'class':80C 'cmd':115C 'command':93C 'commit':68C 'connect':104C 'contain':70C 'cross':106C 'cross-sit':105C 'e88f6876745427321eb755ebc98276063a962d8a':69C 'exampl':84C 'execut':91C 'hostlink':79C 'loopback':111C 'messag':116C 'minecraft':92C 'miss':72C 'mod':85C 'modder':66C 'open':97C 'oper':121C 'origin':74C 'page':96C 'passthrough':83C 'player':100C 'remot':88C 'run':119C 'send':114C 'site':107C 'unauthent':110C 'univers':65C 'universal-modd':64C 'valid':75C 'vulner':76C 'web':95C 'websocket':73C,112C 'worldbridge.command':118C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-06T08:19:26+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125358","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125358","severity":null,"published_at":"2026-11-10T00:17:07+00:00","modified_at":"2026-11-10T00:17:07+00:00","first_seen_at":"2026-11-10T00:28:41+00:00","fetched_at":"2026-11-10T00:28:41+00:00","note":null}],"documents":[{"id":111492,"url":"https://github.com/rehan-remade/universal-modder/commit/e88f6876745427321eb755ebc98276063a962d8a","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":111493,"url":"https://github.com/rehan-remade/universal-modder/security/advisories/GHSA-wjf6-3h6v-4gq9","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-06T08:19:26+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":111494,"url":"https://www.vulncheck.com/advisories/universal-modder-before-e88f687-cross-site-websocket-command-execution-via-hostlink","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}