| Название | vibesurf-ai VibeSurf commit : cd6e519d507cdd4d63061300bf60fb176e1f57e0 Remote Code Execution |
|---|
| Описание | The https://github.com/vibesurf-ai/VibeSurf project is vulnerable to an unauthenticated Remote code execution vulnerability. The `/code` validation endpoint allows remote users to submit arbitrary Python source code for validation without authentication. During validation, the application parses the supplied source code into an AST, compiles discovered function definitions, and executes them using Python's built-in `exec()` function. Because Python evaluates decorators, default parameter expressions, and annotations when creating a function object, attacker-controlled code is executed during the validation process. The endpoint is accessible without authentication, allowing any remote attacker to achieve arbitrary code execution by submitting a crafted request. This results in unauthenticated remote code execution (RCE) on the server. |
|---|
| Источник | ⚠️ https://asciinema.org/a/1230301 |
|---|
| Пользователь | Allan Njuguna (UID 57480) |
|---|
| Представление | 11.06.2026 19:22 (2 месяцы назад) |
|---|
| Модерация | 04.08.2026 09:17 (2 months later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 385776 [vibesurf-ai VibeSurf до cd6e519d507cdd4d63061300bf60fb176e1f57e0 Python Validation /code эскалация привилегий] |
|---|
| Баллы | 19 |
|---|