| عنوان | vibesurf-ai VibeSurf commit : cd6e519d507cdd4d63061300bf60fb176e1f57e0 Remote Code Execution |
|---|
| الوصف | The https://github.com/vibesurf-ai/VibeSurf project is vulnerable to an unauthenticated Remote code execution vulnerability. The `/code` validation endpoint allows remote users to submit arbitrary Python source code for validation without authentication. During validation, the application parses the supplied source code into an AST, compiles discovered function definitions, and executes them using Python's built-in `exec()` function. Because Python evaluates decorators, default parameter expressions, and annotations when creating a function object, attacker-controlled code is executed during the validation process. The endpoint is accessible without authentication, allowing any remote attacker to achieve arbitrary code execution by submitting a crafted request. This results in unauthenticated remote code execution (RCE) on the server. |
|---|
| المصدر | ⚠️ https://asciinema.org/a/1230301 |
|---|
| المستخدم | Allan Njuguna (UID 57480) |
|---|
| ارسال | 11/06/2026 07:22 PM (2 أشهر منذ) |
|---|
| الاعتدال | 04/08/2026 09:17 AM (2 months later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 385776 [vibesurf-ai VibeSurf حتى cd6e519d507cdd4d63061300bf60fb176e1f57e0 Python Validation /code تجاوز الصلاحيات] |
|---|
| النقاط | 19 |
|---|