This vulnerability in vibesurf-ai VibeSurf up to commit cd6e519d507cdd4d63061300bf60fb176e1f57e0 involves code injection via manipulation of an unknown function in the Python Validation Handler located in the /code component. The flaw allows remote exploitation without authentication or user interaction, potentially enabling attackers to execute arbitrary code. Due to the rolling release approach, no explicit version ranges are specified. The vendor has not issued any advisory or fix, and no known exploits are reported in the wild.

Successful exploitation could allow remote attackers to execute arbitrary code on the affected system, potentially compromising system integrity and confidentiality. The vulnerability does not require privileges or user interaction, increasing the risk of exploitation. However, the impact is rated medium based on the CVSS 6.9 score and limited information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is publicly available, users should monitor official channels for updates. Until a fix is released, consider restricting network exposure of the affected component and applying any available workarounds if documented by the vendor.