CVE-2026-125358: Universal-modder before e88f687 Cross-Site WebSocket Command Execution via HostLink
Universal-modder before commit e88f6876745427321eb755ebc98276063a962d8a contains a missing WebSocket Origin validation vulnerability in the HostLink class of its passthrough example mods that allows remote attackers to execute Minecraft commands. Any web page open in the player's browser can connect cross-site to the unauthenticated loopback WebSocket and send cmd messages that WorldBridge.command() runs with operator authority.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Players running an affected Universal-modder passthrough example mod are exposed when its unauthenticated loopback WebSocket is available. A remote attacker only needs the player to have a web page open in their browser.
What does an attacker need to do to exploit this issue?
The attacker must cause the player's browser to open an attacker-controlled web page. That page can make a cross-site connection to the loopback WebSocket and send cmd messages; no prior authentication is required.
What is the impact of a successful exploit?
Sent cmd messages are processed by WorldBridge.command() with operator authority. This allows the attacker to execute Minecraft commands, affecting integrity and availability.
Which versions are affected?
The issue affects Universal-modder versions before commit e88f6876745427321eb755ebc98276063a962d8a.