---
id: "CVE-2026-125358"
page: "https://infrastack.ai/live/CVE-2026-125358"
kind: "vulnerability"
aliases: ["CVE-2026-125358"]
title: "Universal-modder: missing WebSocket origin check lets web pages run Minecraft commands"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["minecraft", "other", "universal-modder", "websocket"]
not_affected_if: ["example-mods-not-used"]
published_at: "2026-11-10T00:17:07+00:00"
first_seen_at: "2026-11-10T00:28:41+00:00"
updated_at: "2026-11-10T00:29:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125358", "first_seen_at": "2026-11-10T00:28:41+00:00"}]
exploit_sources: []
---

# Universal-modder: missing WebSocket origin check lets web pages run Minecraft commands

Link for people: https://infrastack.ai/live/CVE-2026-125358 (this .md is for agents)

Universal-modder's passthrough example mods accept WebSocket connections from any website without checking the origin. A web page open in a player's browser can send commands that the mod runs with operator authority in Minecraft.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the project's example mods (the HostLink class in the passthrough example) are installed or used from a commit before `e88f6876745427321eb755ebc98276063a962d8a`

## Fix

- Move to a commit at or after `e88f6876745427321eb755ebc98276063a962d8a`, per the patch linked in the sources

## Timeline

- 2026-11-10T00:28:41+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125358

## Documents

- [advisory] Vendor advisory: github.com https://github.com/rehan-remade/universal-modder/security/advisories/GHSA-wjf6-3h6v-4gq9
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/universal-modder-before-e88f687-cross-site-websocket-command-execution-via-hostlink
- [fix] Patch: github.com https://github.com/rehan-remade/universal-modder/commit/e88f6876745427321eb755ebc98276063a962d8a

## From the sources

Universal-modder before commit e88f6876745427321eb755ebc98276063a962d8a contains a missing WebSocket Origin validation vulnerability in the HostLink class of its passthrough example mods that allows remote attackers to execute Minecraft commands. Any web page open in the player's browser can connect cross-site to the unauthenticated loopback WebSocket and send cmd messages that WorldBridge.command() runs with operator authority.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_