Vulnerability · Published Feb 16, 2026 · Assigned by VulDB

CVE-2026-2544yued-fe LuLu UI run.js child_process.exec os command injection

High 7.3

In plain English

A high-severity OS command injection in LuLu UI from yued-fe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.2% (higher than 88% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)3.2%top 11.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A security flaw has been discovered in yued-fe LuLu UI up to 3.0.0. This issue affects the function child_process.exec of the file run.js. The manipulation results in os command injection. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
yued-fe	LuLu UI	3.0

Weakness: CWE-78, CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R

References

VDB-346153 | yued-fe LuLu UI run.js child_process.exec os command injection vdb-entry, technical-description
VDB-346153 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #749722 | Yued Fe Lulu UI 3 OS Command Injection third-party-advisory
https://github.com/lakshayyverma/CVE-Discovery/blob/main/lulu.md related