Remote Code Execution Vulnerability in gin-vue-admin by Flipped Aurora
CVE-2026-48787

7.4HIGH

Key Information:

Vendor

Flipped-aurora

Status
Gin-vue-admin
Vendor
CVE Published:
19 June 2026

What is CVE-2026-48787?

The gin-vue-admin platform, version 2.9.1, is susceptible to a remote code execution vulnerability where an authenticated user can exploit the code-generation feature. This is achieved by injecting malicious Go source code through the POST /autoCode/addFunc endpoint. Following this, the attacker can trigger a rebuild of the MCP service with POST /autoCode/mcpStart, executing arbitrary operating system commands with the application's privileges. This poses significant security risks, including potential modification of backend logic, unauthorized access to application data, and the establishment of persistent backdoors. The impact is exacerbated in setups that allow source code modifications and local builds. To mitigate risks, it's essential to implement strict validation on pertinent fields.

Affected Version(s)

gin-vue-admin = 2.9.1

References

https://github.com/flipped-aurora/gin-vue-admin/security/...
x_refsource_CONFIRM

CVSS V4

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.