GHSA-v2f8-6655-7grj
Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain
5 findings — unauthenticated full-API exposure (F1, lead Critical), read-side authorization gap that persists even with API_AUTH_KEY set (F2), unauthenticated file write of .py/.sh/.yaml to a server-returned path (F3), default-permissive CORS that combines with a loopback-only check to grant any browser page on whitelisted localhost ports credentialed cross-origin access (F-A4), and partial…
- No known exploitation
- Severity
- Critical, CVSS 10.0 (v3.1)
- Affected packages
- vibe-trading-ai (pip) >= 0.1.0, < 0.1.7, fixed in 0.1.7 · GHSA-v2f8-6655-7grj