PT-2026-43403 · Prolix Oc · Lumiverse
CVSS v3.1
9.3
Critical
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Lumiverse versions prior to 0.9.7
Description
The component override system transpiles user-supplied TSX using Sucrase and evaluates it via
new Function. To prevent malicious execution, the system attempts to shadow dangerous globals such as fetch, window, and eval by setting them to undefined and uses a static source validator, validateComponentOverrideSource(), to block these identifiers using word-boundary regex. However, both controls can be bypassed. The static validator can be evaded by reconstructing blocked identifiers from string fragments at runtime. Additionally, a sandbox escape is possible using useRef and useEffect; by attaching a ref to a rendered element, an attacker can obtain a live DOM node and access the real window object via node['ownerDoc'+'ument']['def'+'aultView']. This allows the execution of arbitrary code within an authenticated session when a victim imports and enables a malicious theme pack (.lumitheme or .lumiverse-theme) in the Theme Editor.Recommendations
Update Lumiverse to version 0.9.7.
Exploit
Fix
Protection Mechanism Failure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Lumiverse