CVE-2018-1000621

8.1 highEPSS 2.6%

High (8.1) in mycroft mycroft-core. EPSS 2.6% chance of exploitation in the next 30 days.

Mycroft AI mycroft-core version 18.2.8b and earlier contains a Incorrect Access Control vulnerability in Websocket configuration that can result in code execution. This impacts ONLY the Mycroft for Linux and "non-enclosure" installs - Mark 1 and Picroft unaffected. This attack appear to be exploitable remote access to the unsecured websocket server. This vulnerability appears to have been fixed in No fix currently available.

Severity

CVSS 3.0

8.1 high

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.6% chance of exploitation in the next 30 days; higher than 85% of CVEs (scores of 2026-10-31)
CWE: CWE-732
Published: 2018-07-09
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

mycroft:mycroft-core

References

https://community.mycroft.ai/t/zero-click-remote-code-execution-in-mycroft-ai-vocal-assistant/3930/13
https://github.com/Nhoya/MycroftAI-RCE
https://community.mycroft.ai/t/zero-click-remote-code-execution-in-mycroft-ai-vocal-assistant/3930/13
https://github.com/Nhoya/MycroftAI-RCE

Check your stack JSON