Vulnerability · Published Aug 4, 2026 · Assigned by VulDB

CVE-2026-18770vibesurf-ai VibeSurf Python Validation code code injection

High 7.3

In plain English

A high-severity code injection in VibeSurf from vibesurf-ai. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.4%top 68.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in vibesurf-ai VibeSurf up to cd6e519d507cdd4d63061300bf60fb176e1f57e0. Impacted is an unknown function of the file /code of the component Python Validation Handler. The manipulation leads to code injection. Remote exploitation of the attack is possible. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
vibesurf-ai	VibeSurf	cd6e519d507cdd4d63061300bf60fb176e1f57e0

Weakness: CWE-94, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-385776 | vibesurf-ai VibeSurf Python Validation code code injection vdb-entry
VDB-385776 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-18770 | CVE Analysis and Report third-party-advisory
Submit #856224 | vibesurf-ai VibeSurf commit : cd6e519d507cdd4d63061300bf60fb176e1f57e0 Remote Code Execution third-party-advisory
https://asciinema.org/a/1230301 related