| 제목 | vibesurf-ai VibeSurf commit : cd6e519d507cdd4d63061300bf60fb176e1f57e0 Remote Code Execution |
|---|
| 설명 | The https://github.com/vibesurf-ai/VibeSurf project is vulnerable to an unauthenticated Remote code execution vulnerability. The `/code` validation endpoint allows remote users to submit arbitrary Python source code for validation without authentication. During validation, the application parses the supplied source code into an AST, compiles discovered function definitions, and executes them using Python's built-in `exec()` function. Because Python evaluates decorators, default parameter expressions, and annotations when creating a function object, attacker-controlled code is executed during the validation process. The endpoint is accessible without authentication, allowing any remote attacker to achieve arbitrary code execution by submitting a crafted request. This results in unauthenticated remote code execution (RCE) on the server. |
|---|
| 원천 | ⚠️ https://asciinema.org/a/1230301 |
|---|
| 사용자 | Allan Njuguna (UID 57480) |
|---|
| 제출 | 2026. 06. 11. PM 07:22 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 08. 04. AM 09:17 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 385776 [vibesurf-ai VibeSurf 까지 cd6e519d507cdd4d63061300bf60fb176e1f57e0 Python Validation /code 권한 상승] |
|---|
| 포인트들 | 19 |
|---|