{"action":"Upgrade vibe-trading-ai to 0.1.7 or later.","affected":[{"fixed":"0.1.7","introduced":"0.1.0"}],"component":"vibe-trading-ai","cve_ids":["CVE-2026-114106"],"ecosystem":"PyPI","exploited":false,"fixed_versions":["0.1.7"],"ghsa_id":"GHSA-5rmq-chc7-m22f","id":"tcs_01M5JKSAK2SA9X0X3WQ4R96X3N","modified_at":"2026-10-21T10:57:24.141394826Z","published_at":"2026-10-02T22:44:12Z","references":["https://osv.dev/vulnerability/GHSA-5rmq-chc7-m22f","https://github.com/HKUDS/Vibe-Trading/security/advisories/GHSA-5rmq-chc7-m22f","https://github.com/HKUDS/Vibe-Trading/commit/9454d4a27a763b80e1d6eb5763b86c88e9e4e714","https://github.com/HKUDS/Vibe-Trading","https://github.com/HKUDS/Vibe-Trading/releases/tag/v0.1.7"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-5rmq-chc7-m22f","url":"https://osv.dev/vulnerability/GHSA-5rmq-chc7-m22f"}],"summary":"Vibe-Trading file-read tools expose arbitrary server-readable files"}