Lumiverse’s component override system compiles user‑supplied TSX through Sucrase and executes it with new Function, expecting to block dangerous globals by setting them to undefined and by static validation that rejects certain identifiers. Both measures are bypassed: a string‑split technique reconstructs blocked identifiers at runtime, and a DOM reference escape exposes the real window object via a referenced element’s document property. The result is that malicious code runs in the context of the authenticated user, giving full remote code execution within that session.

The vulnerability affects the Lumiverse application from the vendor prolix‑oc. Versions earlier than 0.9.7 are affected. The issue is present in the component override system that processes theme packages (files with .lumitheme or .lumiverse‑theme extensions).

The CVSS score of 9.3 indicates critical severity. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog. The attack requires an authenticated user to import an attacker‑supplied theme and enable a component override through the Theme Editor. From there, the payload runs with the privileges of the user, allowing exfiltration or modification of any data the user can access. The exploit is relatively simple, needing only UI interaction, making it high risk for environments that allow external theme files.