vibe-trading-ai
PyPI3 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting vibe-trading-aipage 1 of 1
- CVE-2026-114106HIGHCVSS 7.5EG 7.5fixed in 0.1.72026-10-21
vulnerable: 0.1.0 ... 0.1.6 (7 versions)
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability that allows remote attackers to read sensitive server files through LLM agent file-read tools. Attackers can prompt the agent to invoke read_document, which…
- CVE-2026-114107HIGHCVSS 8.8EG 8.8fixed in 0.1.72026-10-21
vulnerable: 0.1.0 ... 0.1.6 (7 versions)
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as root by planting instructions in documents or web pages the agent processes. BashTool …
- CVE-2026-114108CRITICALCVSS 9.8EG 9.8fixed in 0.1.72026-10-21
vulnerable: 0.1.0 ... 0.1.6 (7 versions)
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because require_auth() returns early when API_AUTH_KEY is unset. Attackers can p…
Check whether vibe-trading-ai is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for vibe-trading-ai CVEs against the assets you own.
Book a Demo →