CVE-2026-7595

MediumCVSS 6.3

Published: 01/05/2026(UTC)Updated: 26/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

15th percentile - higher than 15% of all known CVEs

Summary

A vulnerability was detected in ui-ux-pro-max-skill up to 2.5.0 in the _format_plugins function of tailwind_config_gen.py (Tailwind Config Generator). Manipulation causes code injection. The attack can be carried out remotely and the exploit is publicly available.

Risk Assessment

Potential code injection via the _format_plugins function may lead to arbitrary code execution. The public exploit increases the risk.

Recommendation

Update the project to a fixed version or implement input validation in the config generator. Monitor script usage.

Other vulnerabilities in ui-ux-pro-max-skill

CVE-2026-7596Medium
In nextlevelbuilder ui-ux-pro-max-skill up to 2.5.0, the data.get function in generate-slide.py of the Slide Generator component leads to cross-site scripting. The attack can be performed remotely and the exploit has been publicly disclosed. The project was informed but has not reacted.

Original NVD description (English source)

A flaw has been found in nextlevelbuilder ui-ux-pro-max-skill up to 2.5.0. Affected by this vulnerability is the function _format_plugins of the file .claude/skills/ui-styling/scripts/tailwind_config_gen.py of the component Tailwind Config Generator. This manipulation causes code injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. The project was informed of the problem early through a pull request but has not reacted yet.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS