CVE-2026-44451

Lumiverse is a full-featured AI chat application. Prior to 0.9.7, the component override system transpiles user-supplied TSX via Sucrase and evaluates it with new Function, shadowing dangerous globals (fetch, window, eval, etc.) with undefined. A static source validator (validateComponentOverrideSource) additionally blocks these identifiers by word-boundary regex. Both controls are bypassed. String-split bypass of the static validator: any blocked identifier can be reconstructed at runtime from string fragments ('ownerDoc' + 'ument'). DOM ref escape from the sandbox: useRef and useEffect are provided in scope. A ref attached to a rendered element gives a live DOM node. From any real DOM node, node['ownerDoc'+'ument']['def'+'aultView'] yields the real window, bypassing all identifier shadows. Theme packs (.lumitheme / .lumiverse-theme) are the shareable delivery mechanism. A malicious pack is an exploit path: the victim imports the file, enables one component override in the Theme Editor, and the payload fires in their authenticated session.This vulnerability is fixed in 0.9.7.

• CWE-693

• https://github.com/prolix-oc/Lumiverse/security/advisories/GHSA-rgp6-55rw-5xf4
• https://github.com/prolix-oc/Lumiverse/security/advisories/GHSA-rgp6-55rw-5xf4

Published

May 26, 2026

Last Modified

Jul 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44446ERPNext is a free and open source Enterprise Resource Planni…7.5
• CVE-2026-44447ERPNext is a free and open source Enterprise Resource Planni…7.5
• CVE-2026-44448ERPNext is a free and open source Enterprise Resource Planni…6.5
• CVE-2026-44449Lumiverse is a full-featured AI chat application. Prior to 0…9.1
• CVE-2026-4445Use after free in WebRTC in Google Chrome prior to 146.0.768…8.8
• CVE-2026-44450Lumiverse is a full-featured AI chat application. Prior to 0…9.9
• CVE-2026-44452h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and …5.9
• CVE-2026-44453h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and …7.5
• CVE-2026-44454Coder allows organizations to provision remote development e…8.8
• CVE-2026-44455Hono is a Web application framework that provides support fo…6.1
• CVE-2026-44456Hono is a Web application framework that provides support fo…6.5
• CVE-2026-44457Hono is a Web application framework that provides support fo…5.3