Answer in brief
CVE-2026-125358 records a High severity (CVSS 7.2) vulnerability in Universal-modder before e88f687 Cross-Site WebSocket Command Execution via HostLink. The current sources do not mark it as known exploited. The current feed maps rehan-remade/universal-modder (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.2. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps rehan-remade/universal-modder (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| rehan-remade/universal-moddergeneric | >=0 <e88f6876745427321eb755ebc98276063a962d8a | e88f6876745427321eb755ebc98276063a962d8a |
Published upstream
Nov 9, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 9, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 9, 2026
Universal-modder before commit e88f6876745427321eb755ebc98276063a962d8a contains a missing WebSocket Origin validation vulnerability in the HostLink class of its passthrough example mods that allows remote attackers to execute Minecraft commands. Any web page open in the player's browser can connect cross-site to the unauthenticated loopback WebSocket and send cmd messages that WorldBridge.command() runs with operator authority.
Quoted source text, attributed separately from HOL analysis.