A malicious Lumiverse extension can supply a package.json containing preinstall, postinstall, or prepare lifecycle scripts. During the build pipeline for the Spindle extension, bun install is executed without the --ignore-scripts flag before the static backend safety scan runs. When an administrator installs this extension, the lifecycle scripts execute immediately, allowing the attacker to run arbitrary code with host privileges. This flaw is a typical command injection type weakness identified as CWE‑78 and results in full compromise of the system where Lumiverse runs.

Products affected are Lumiverse, versions prior to 0.9.7 of the Spindle extension build pipeline. No specific patch versions are listed beyond the fixed release 0.9.7. Hosts running the Lumiverse chat application that allows administrators to install extensible Spindle modules are at risk.

The CVSS score of 9.1 indicates critical severity. The EPSS score is not available, so the current exploit probability is uncertain, but the vulnerability was publicly disclosed and listed in a GitHub advisory, suggesting that it may be actively exploited. The vulnerability is not listed in the CISA KEV catalog. Attackers need administrative privileges to install the extension, but once the administrator acts, the attack is immediate and requires no further interaction.