CVE-2026-114107
1 advisory.
PyPI/vibe-trading-ai CVE-2026-114107: critical 10
Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF
Action: Upgrade vibe-trading-ai to 0.1.7 or later.
pip install vibe-trading-ai==0.1.7Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.1.0 | 0.1.7 | - |
Fixed versions
| 0.1.7 |
Sources
- osv: GHSA-jqmf-mx4f-hfr6
- https://github.com/HKUDS/Vibe-Trading/security/advisories/GHSA-jqmf-mx4f-hfr6
- https://github.com/HKUDS/Vibe-Trading/commit/9454d4a27a763b80e1d6eb5763b86c88e9e4e714
- https://github.com/HKUDS/Vibe-Trading
- https://github.com/HKUDS/Vibe-Trading/releases/tag/v0.1.7
CVE-2026-114107 · published · modified · JSON