CVE-2026-18770

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-18770", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-08-04T07:17:11.200Z", "datePublished": "2026-08-04T14:45:09.411Z", "dateUpdated": "2026-08-04T14:59:33.510Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-08-04T14:45:09.411Z"}, "title": "vibesurf-ai VibeSurf Python Validation code code injection", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "Code Injection"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-74", "lang": "en", "description": "Injection"}]}], "affected": [{"vendor": "vibesurf-ai", "product": "VibeSurf", "versions": [{"version": "cd6e519d507cdd4d63061300bf60fb176e1f57e0", "status": "affected"}], "cpes": ["cpe:2.3:a:vibesurf-ai:vibesurf:*:*:*:*:*:*:*:*"], "modules": ["Python Validation Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in vibesurf-ai VibeSurf up to cd6e519d507cdd4d63061300bf60fb176e1f57e0. Impacted is an unknown function of the file /code of the component Python Validation Handler. The manipulation leads to code injection. Remote exploitation of the attack is possible. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "HIGH"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "HIGH"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-08-04T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-08-04T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-08-04T09:22:16.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Allan Njuguna (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/385776", "name": "VDB-385776 | vibesurf-ai VibeSurf Python Validation code code injection", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/385776/cti", "name": "VDB-385776 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-18770", "name": "CVE-2026-18770 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/856224", "name": "Submit #856224 | vibesurf-ai VibeSurf commit : cd6e519d507cdd4d63061300bf60fb176e1f57e0 Remote Code Execution", "tags": ["third-party-advisory"]}, {"url": "https://asciinema.org/a/1230301", "tags": ["related"]}], "x_generator": ["VulDB PVTS v202608"]}, "adp": [{"references": [{"url": "https://asciinema.org/a/1230301", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-04T14:59:22.704614Z", "id": "CVE-2026-18770", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-04T14:59:33.510Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-18770", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-04T14:59:22.704614Z"}}}], "references": [{"url": "https://asciinema.org/a/1230301", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-04T14:59:06.708Z"}}], "cna": {"title": "vibesurf-ai VibeSurf Python Validation code code injection", "credits": [{"lang": "en", "type": "reporter", "value": "Allan Njuguna (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:vibesurf-ai:vibesurf:*:*:*:*:*:*:*:*"], "vendor": "vibesurf-ai", "modules": ["Python Validation Handler"], "product": "VibeSurf", "versions": [{"status": "affected", "version": "cd6e519d507cdd4d63061300bf60fb176e1f57e0"}]}], "timeline": [{"lang": "en", "time": "2026-08-04T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-08-04T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-08-04T09:22:16.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/385776", "name": "VDB-385776 | vibesurf-ai VibeSurf Python Validation code code injection", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/385776/cti", "name": "VDB-385776 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-18770", "name": "CVE-2026-18770 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/856224", "name": "Submit #856224 | vibesurf-ai VibeSurf commit : cd6e519d507cdd4d63061300bf60fb176e1f57e0 Remote Code Execution", "tags": ["third-party-advisory"]}, {"url": "https://asciinema.org/a/1230301", "tags": ["related"]}], "x_generator": ["VulDB PVTS v202608"], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in vibesurf-ai VibeSurf up to cd6e519d507cdd4d63061300bf60fb176e1f57e0. Impacted is an unknown function of the file /code of the component Python Validation Handler. The manipulation leads to code injection. Remote exploitation of the attack is possible. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "Code Injection"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-74", "description": "Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-08-04T14:45:09.411Z"}}}, "cveMetadata": {"cveId": "CVE-2026-18770", "state": "PUBLISHED", "dateUpdated": "2026-08-04T14:59:33.510Z", "dateReserved": "2026-08-04T07:17:11.200Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-08-04T14:45:09.411Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:vibesurf-ai:vibesurf:*:*:*:*:*:*:*:*"], "modules": ["Python Validation Handler"], "product": "VibeSurf", "vendor": "vibesurf-ai", "versions": [{"status": "affected", "version": "cd6e519d507cdd4d63061300bf60fb176e1f57e0"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in vibesurf-ai VibeSurf up to cd6e519d507cdd4d63061300bf60fb176e1f57e0. Impacted is an unknown function of the file /code of the component Python Validation Handler. The manipulation leads to code injection. Remote exploitation of the attack is possible. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Se ha encontrado una vulnerabilidad en vibesurf-ai VibeSurf hasta cd6e519d507cdd4d63061300bf60fb176e1f57e0. Afectada es una funci\u00f3n desconocida del archivo /code del componente Gestor de Validaci\u00f3n de Python. La manipulaci\u00f3n conduce a la inyecci\u00f3n de c\u00f3digo. La explotaci\u00f3n remota del ataque es posible. Este producto sigue un modelo de lanzamiento continuo para la entrega continua, por lo que no se proporcionan detalles de versi\u00f3n para las versiones afectadas o actualizadas. Se contact\u00f3 al proveedor con antelaci\u00f3n sobre esta divulgaci\u00f3n, pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-18770", "lastModified": "2026-10-23T23:10:00.157", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18770", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-04T14:59:22.704614Z", "version": "2.0.3"}}]}, "published": "2026-08-04T15:16:34.043", "references": [{"source": "cna@vuldb.com", "url": "https://asciinema.org/a/1230301"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-18770"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/856224"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/385776"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/385776/cti"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://asciinema.org/a/1230301"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}, {"lang": "en", "value": "CWE-94"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "cd6e519d507cdd4d63061300bf60fb176e1f57e0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "VibeSurf", "source": "cna", "vendor": "vibesurf-ai"}, "product": "vibesurf", "vendor": "vibesurf-ai"}], "created": "2026-08-04T20:00:05.155676+00:00", "updated": "2026-08-05T10:19:51.036824+00:00", "vendors": ["vibesurf-ai", "vibesurf-ai$PRODUCT$vibesurf"]}