Vibesurf
Monthly
Code injection in VibeSurf's Python Validation Handler enables remote unauthenticated attackers to inject and execute arbitrary Python code by manipulating the /code endpoint. All versions up to commit cd6e519d507cdd4d63061300bf60fb176e1f57e0 are confirmed affected per EUVD-2026-52704. No patch is available - the vendor did not respond to disclosure - and a public proof-of-concept exists (CVSS 4.0 E:P, corroborated by an asciinema recording in the references), making exploitation accessible to low-skilled attackers.
Code injection in VibeSurf's Python Validation Handler enables remote unauthenticated attackers to inject and execute arbitrary Python code by manipulating the /code endpoint. All versions up to commit cd6e519d507cdd4d63061300bf60fb176e1f57e0 are confirmed affected per EUVD-2026-52704. No patch is available - the vendor did not respond to disclosure - and a public proof-of-concept exists (CVSS 4.0 E:P, corroborated by an asciinema recording in the references), making exploitation accessible to low-skilled attackers.