A code injection vulnerability has been identified in vibesurf-ai VibeSurf up to commit cd6e519d507cdd4d63061300bf60fb176e1f57e0. The flaw resides in an unknown function within the /code file of the Python Validation Handler component. An attacker can manipulate input to trigger code injection remotely. The product uses a rolling release model, making specific version tracking difficult. The vulnerability is remotely exploitable, raising the severity of the issue. No patch or version fix details are available due to the continuous delivery approach. The vendor was notified prior to public disclosure but did not respond. This lack of vendor response leaves users without an official fix or mitigation guidance. The vulnerability is tracked as CVE-2026-18770 and is listed on NVD.