CVE-2026-7595

medium

Description

A flaw has been found in nextlevelbuilder ui-ux-pro-max-skill up to 2.5.0. Affected by this vulnerability is the function _format_plugins of the file .claude/skills/ui-styling/scripts/tailwind_config_gen.py of the component Tailwind Config Generator. This manipulation causes code injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. The project was informed of the problem early through a pull request but has not reacted yet.

References

https://vuldb.com/vuln/360548/cti

https://vuldb.com/vuln/360548

https://vuldb.com/submit/805509

https://github.com/nextlevelbuilder/ui-ux-pro-max-skill/pull/275

https://github.com/nextlevelbuilder/ui-ux-pro-max-skill/issues/246

https://github.com/nextlevelbuilder/ui-ux-pro-max-skill/

Details

Source: Mitre, NVD

Published: 2026-05-01

Updated: 2026-05-01

Risk Information

CVSS v2

Base Score: 6.5

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P

Severity: Medium

CVSS v3

Base Score: 6.3

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Severity: Medium

CVSS v4

Base Score: 5.3

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Severity: Medium