| Title | vibesurf-ai VibeSurf commit : cd6e519d507cdd4d63061300bf60fb176e1f57e0 Remote Code Execution |
|---|
| Description | The https://github.com/vibesurf-ai/VibeSurf project is vulnerable to an unauthenticated Remote code execution vulnerability. The `/code` validation endpoint allows remote users to submit arbitrary Python source code for validation without authentication. During validation, the application parses the supplied source code into an AST, compiles discovered function definitions, and executes them using Python's built-in `exec()` function. Because Python evaluates decorators, default parameter expressions, and annotations when creating a function object, attacker-controlled code is executed during the validation process. The endpoint is accessible without authentication, allowing any remote attacker to achieve arbitrary code execution by submitting a crafted request. This results in unauthenticated remote code execution (RCE) on the server. |
|---|
| Source | ⚠️ https://asciinema.org/a/1230301 |
|---|
| User | Allan Njuguna (UID 57480) |
|---|
| Submission | 06/11/2026 19:22 (2 months ago) |
|---|
| Moderation | 08/04/2026 09:17 (2 months later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 385776 [vibesurf-ai VibeSurf up to cd6e519d507cdd4d63061300bf60fb176e1f57e0 Python Validation /code code injection] |
|---|
| Points | 19 |
|---|