PyPI/vibe-trading-ai CVE-2026-114108: critical 10
Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain
Action: Upgrade vibe-trading-ai to 0.1.7 or later.
pip install vibe-trading-ai==0.1.7Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.1.0 | 0.1.7 | - |
Fixed versions
| 0.1.7 |
Sources
- osv: GHSA-v2f8-6655-7grj
- https://github.com/HKUDS/Vibe-Trading/security/advisories/GHSA-v2f8-6655-7grj
- https://github.com/HKUDS/Vibe-Trading/commit/9454d4a27a763b80e1d6eb5763b86c88e9e4e714
- https://github.com/HKUDS/Vibe-Trading
- https://github.com/HKUDS/Vibe-Trading/releases/tag/v0.1.7
CVE-2026-114108 · published · modified · JSON