CVE-2026-7595
Deferred Deferred - Pending Action
Code Injection in NextLevelBuilder UI-UX-Pro-Max-Skill

Publication date: 2026-05-01

Last updated on: 2026-05-05

Assigner: VulDB

Description
A flaw has been found in nextlevelbuilder ui-ux-pro-max-skill up to 2.5.0. Affected by this vulnerability is the function _format_plugins of the file .claude/skills/ui-styling/scripts/tailwind_config_gen.py of the component Tailwind Config Generator. This manipulation causes code injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. The project was informed of the problem early through a pull request but has not reacted yet.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-01
Last Modified
2026-05-05
Generated
2026-06-16
AI Q&A
2026-05-02
EPSS Evaluated
2026-06-15
NVD
CVE-2026-7595
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
nextlevelbuilder ui-ux-pro-max-skill to 2.5.0 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a flaw in the nextlevelbuilder ui-ux-pro-max-skill software up to version 2.5.0. It exists in the _format_plugins function within the Tailwind Config Generator component, specifically in the file .claude/skills/ui-styling/scripts/tailwind_config_gen.py. The flaw allows an attacker to perform code injection remotely, meaning malicious code can be inserted and executed through this vulnerability.

The vulnerability has been publicly disclosed and an exploit is available, but the project maintainers have not yet addressed the issue.

Impact Analysis

This vulnerability can impact you by allowing a remote attacker to inject and execute arbitrary code within the affected software. This could lead to unauthorized actions such as data manipulation, system compromise, or disruption of service depending on the privileges of the affected component.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-7595. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart