critical vulnerability

Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain

Fix availableCritical · CVSS 10

Published Oct 2, 2026 · updated Oct 2, 2026

What to do

Upgrade to a fixed version: vibe-trading-ai 0.1.7.
Redeploy and restart long-running processes so they load the fixed code.

Affected packages

PyPIvibe-trading-ai2,376 downloads/week

Vulnerable versions: >= 0.1.0, < 0.1.7
Fixed in: 0.1.7

Check your project: pip show vibe-trading-ai

Sources

GitHub Advisory GHSA-v2f8-6655-7grj

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor · CWE-306 Missing Authentication for Critical Function · CWE-434 Unrestricted Upload of File with Dangerous Type · CWE-862 Missing Authorization · CWE-942 Permissive Cross-domain Security Policy with Untrusted Domains

← All critical vulnerabilities