Executive brief
VibeSurf is an AI-powered tool available on GitHub that processes and validates data through a Python validation component. The vulnerability allows unauthenticated attackers to inject and execute arbitrary Python code remotely, potentially gaining full control over systems running the software.
Technical details
The vulnerability is a code injection flaw in the Python Validation Handler component affecting VibeSurf up to commit cd6e519d507cdd4d63061300bf60fb176e1f57e0. The vulnerability exists in an unknown function within the /code file path and allows manipulation leading to arbitrary code execution. The attack is unauthenticated and remotely exploitable over the network. An attacker can execute arbitrary Python code to compromise the affected system. The product follows a rolling release model; the vendor has been contacted but has not responded with a patch or update timeline.
Affected products
- vibesurf-ai VibeSurf up to cd6e519d507cdd4d63061300bf60fb176e1f57e0
Timeline
- 2026-08-04: disclosed: CVE-2026-18770 published
- 2026-05: other: Vendor contacted early but did not respond