PT-2026-8318 · Yued Fe · Lulu Ui

Lakshay12311 · Publicado 2026-02-16 · Atualizado 2026-02-21 · CVE-2026-2544

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions yued-fe LuLu UI versions up to 3.0.0

Description A security flaw exists in yued-fe LuLu UI, specifically in the child process.exec function within the run.js file. This allows for operating system command injection, and the attack can be initiated remotely. The vendor was contacted regarding this issue but did not provide a response.

Recommendations Versions prior to 3.0.1 should be updated. Consider temporarily restricting or disabling the use of the child process.exec function in the run.js file until a patch is available.

Exploit

Correção

OS Command Injection

Command Injection

Enumeração de Fraquezas

CWE-78

CWE-77

Identificadores relacionados

CVE-2026-2544

Produtos afetados

Lulu Ui

Referências · 10

• 🔥 https://github.com/lakshayyverma/CVE-Discovery/blob/main/lulu.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-2544 · Nota de Segurança
• https://t.me/cveNotify/152092 · Publicação no Telegram
• https://vuldb.com/?ctiid.346153 · Nota
• https://t.me/CVEtracker/44797 · Publicação no Telegram
• https://vuldb.com/?submit.749722 · Nota
• https://vuldb.com/?id.346153 · Nota
• https://twitter.com/cracbot/status/2024801269219762503 · Publicação no Twitter
• https://twitter.com/cracbot/status/2025163637489631598 · Publicação no Twitter
• https://twitter.com/SecAideInfo/status/2024070992247894313 · Publicação no Twitter