| タイトル | vibesurf-ai VibeSurf commit : cd6e519d507cdd4d63061300bf60fb176e1f57e0 Remote Code Execution |
|---|
| 説明 | The https://github.com/vibesurf-ai/VibeSurf project is vulnerable to an unauthenticated Remote code execution vulnerability. The `/code` validation endpoint allows remote users to submit arbitrary Python source code for validation without authentication. During validation, the application parses the supplied source code into an AST, compiles discovered function definitions, and executes them using Python's built-in `exec()` function. Because Python evaluates decorators, default parameter expressions, and annotations when creating a function object, attacker-controlled code is executed during the validation process. The endpoint is accessible without authentication, allowing any remote attacker to achieve arbitrary code execution by submitting a crafted request. This results in unauthenticated remote code execution (RCE) on the server. |
|---|
| ソース | ⚠️ https://asciinema.org/a/1230301 |
|---|
| ユーザー | Allan Njuguna (UID 57480) |
|---|
| 送信 | 2026年06月11日 19:22 (2 月 ago) |
|---|
| モデレーション | 2026年08月04日 09:17 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 385776 [vibesurf-ai VibeSurf 迄 cd6e519d507cdd4d63061300bf60fb176e1f57e0 Python Validation /code 特権昇格] |
|---|
| ポイント | 19 |
|---|