A code injection flaw exists in the VibeSurf Python Validation Handler. Input supplied to an unspecified function in the /code component is not properly sanitized, allowing an attacker to embed executable instructions. This flaw can be abused remotely to run arbitrary code on the host, compromising confidentiality, integrity, and availability of the affected system. The vulnerability is mapped to CWE-74 (Improper Input Validation for Code Injection) and CWE-94 (Improperly Controlled Format String).

The issue affects the VibeSurf appliance produced by vibesurf-ai. Version information is limited to the last known commit reference cd6e519d507cdd4d63061300bf60fb176e1f57e0, and the product follows a rolling release delivery model; thus, specific upstream releases unable to be identified at this time. Users should verify if their deployed instance includes code from the /code handler in the Python Validation component.

The CVSS score of 6.9 indicates a moderate risk level. There is no EPSS data, and the vulnerability is not listed in the CISA KEV catalog. Remote exploitation is feasible though the exact access path is inferred to be through external network exposure of the vulnerable handler. Attackers can potentially bypass normal authentication boundaries if the handler is accessible, leveraging the code injection and format string weaknesses to execute arbitrary commands. Given the lack of a publicly available patch, the risk remains until a vendor update is released.