PT-2026-8318 · Yued Fe · Lulu Ui

Lakshay12311 · CVE-2026-2544 · Published 2026-02-16 · Updated 2026-02-21

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions yued-fe LuLu UI versions up to 3.0.0

Description A security flaw exists in yued-fe LuLu UI, specifically in the child process.exec function within the run.js file. This allows for operating system command injection, and the attack can be initiated remotely. The vendor was contacted regarding this issue but did not provide a response.

Recommendations Versions prior to 3.0.1 should be updated. Consider temporarily restricting or disabling the use of the child process.exec function in the run.js file until a patch is available.

Exploit

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2026-2544

Affected Products

Lulu Ui

References · 10

• 🔥 https://github.com/lakshayyverma/CVE-Discovery/blob/main/lulu.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-2544 · Security Note
• https://t.me/cveNotify/152092 · Telegram Post
• https://vuldb.com/?ctiid.346153 · Note
• https://t.me/CVEtracker/44797 · Telegram Post
• https://vuldb.com/?submit.749722 · Note
• https://vuldb.com/?id.346153 · Note
• https://twitter.com/cracbot/status/2024801269219762503 · Twitter Post
• https://twitter.com/cracbot/status/2025163637489631598 · Twitter Post
• https://twitter.com/SecAideInfo/status/2024070992247894313 · Twitter Post