The vulnerability stems from a missing WebSocket Origin validation in the HostLink class of the passthrough example mods of Universal‑modder. This flaw allows a remote attacker to send specially crafted "cmd" messages over an unauthenticated loopback WebSocket connection. The server processes these messages as the WorldBridge.command() call and executes them with operator authority, effectively permitting arbitrary command execution. The weakness is categorized as CWE-1385, an improper validation of WM protocol origin.

The affected software is rehan‑remade’s Universal‑modder, specifically the passthrough examples that rely on the HostLink class. Any installation running a version before commit e88f6876745427321eb755ebc98276063a962d8a is vulnerable. Versions newer than this commit contain the patch.

The CVSS base score of 7.2 indicates a high impact due to the potential to change system state when operator privileges are achieved. The EPSS score is not available, so the current calculation of exploitation likelihood is uncertain. The vulnerability is not listed in CISA KEV, which does not indicate known active exploitation but still represents a significant risk. Likely exploitation requires a user with an active Universal‑modder client to have a browser tab open to a malicious web page, which can then connect across the localhost WebSocket and issue commands. The attack vector is inferred from the description as a web‑based cross‑origin request that can be executed by a player’s client.