ui-ux-pro-max-skill EUVD-2026-26719

Exploitation requires authenticated access to the application (PR:L in CVSS vector) - an attacker must have valid user credentials or have compromised an existing account. The attacker must access the Tailwind Config Generator component and be able to submit or edit plugin configuration values (specifically the plugins array in self.config). No special configuration is required beyond standard deployment of the vulnerable version up to 2.5.0. The Tailwind Config Generator must be in use within the application; organizations not using this component are not affected. Network access to the application is required (AV:N), but the attack does not require user interaction (UI:N) beyond credential acquisition. Default configurations of ui-ux-pro-max-skill versions 2.5.0 and earlier contain the vulnerable code; the vulnerability exists out-of-the-box without requiring additional feature enablement.

CVSS 6.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) indicates network-exploitable code injection requiring authenticated access but low attack complexity and no user interaction. EPSS data is not provided, but the E:P flag (exploit published) confirms publicly available POC. The PR:L (requires login) requirement significantly limits real-world risk compared to unauthenticated vectors - attackers must already have valid credentials. However, the C:L/I:L/A:L impact scores signal code execution capability affecting confidentiality, integrity, and availability. The combination of published exploit, confirmed patch availability, and authenticated-only requirement suggests this is a moderate-priority issue: critical for organizations where user accounts are compromised or insider threats exist, but lower urgency than network-exploitable RCE. The unvalidated code generation pattern is a systematic weakness; defenders should verify whether similar injection points exist elsewhere in the codebase.

An authenticated attacker with user account access to the ui-ux-pro-max-skill application submits a malicious plugin name such as 'tailwindcss-evil'; require('tailwindcss-evil'); process.exit(1); // (bypassing the intended require() call) or '@scope/pkg"; maliciousCode(); "' via the Tailwind Config Generator UI. The unvalidated _format_plugins function generates a config file containing the injected code. When the config is processed or deployed, the arbitrary JavaScript executes in the application runtime, potentially exfiltrating secrets, modifying files, or compromising the build pipeline. The published POC (linked in GitHub issue #246) demonstrates this attack vector.