critical vulnerability

Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF

Fix availableCritical · CVSS 10

Published Oct 2, 2026 · updated Oct 2, 2026

What to do

Upgrade to a fixed version: vibe-trading-ai 0.1.7.
Redeploy and restart long-running processes so they load the fixed code.

Affected packages

PyPIvibe-trading-ai2,376 downloads/week

Vulnerable versions: >= 0.1.0, < 0.1.7
Fixed in: 0.1.7

Check your project: pip show vibe-trading-ai

Sources

GitHub Advisory GHSA-jqmf-mx4f-hfr6

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection') · CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') · CWE-94 Improper Control of Generation of Code ('Code Injection') · CWE-116 Improper Encoding or Escaping of Output · CWE-918 Server-Side Request Forgery (SSRF)

← All critical vulnerabilities