CVE-2026-44444 Details

A critical vulnerability in the Lumiverse AI chat application, specifically in versions prior to 0.9.7, allows for host-level code execution via the Spindle extension build pipeline. The issue arises because 'bun install' is executed without the '--ignore-scripts' flag, enabling malicious extensions to run lifecycle scripts before any distribution files are reviewed. This vulnerability is particularly concerning for extensions that include 'preinstall', 'postinstall', or 'prepare' scripts, as they can execute code on the server the moment an admin initiates the installation. The problem is compounded by the fact that the update process can inadvertently introduce malicious behavior by executing newly added scripts from previously benign extensions.

Users can upgrade to Lumiverse version 0.9.7 or later, where this vulnerability has been patched. For those using affected versions, the 'Spindle' extension manager can be manually updated to version 0.9.7.