Vulnerabilities

Vulnerability · CVE-2026-114107

Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF

Published Oct 2, 2026 · catalog updated Oct 21, 2026 · Vibe-Trading LLM-callable tools permit

Open the advisory

Exploitation likelihood is not on this record for CVE-2026-114107. A missing EPSS score is not a low risk. Compare Vibe-Trading LLM-callable tools permit with the linked advisory before you change production.

Severity

Critical10.0

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

Awaiting synchronization with FIRST

Remediation

Advisory link

Affected products

PyPI vibe-trading-ai

### Summary: 5 findings — shell-injection sink (F6, the canonical RCE primitive), async shell-injection sink (F7), backtest runs top-level statements before the class check (F8 — independent RCE path that does not match BashTool signatures), outbound HTTP forwarding without schema/host validation (F-B4 SSRF), and Jinja2 codegen with autoescape disabled for templates (F-B5, defense-in-depth code-injection sink). --- ### Shared baseline (applies to all 5 findings) All five tools are members of the **auto-discovered tool registry** the LLM agent gets at startup; the LLM is free to call any of them based on the user prompt. The tool registration is unconditional in default config — no operator opt-in flag gates them. Combined with GHSA-1 / F1 (unauthenticated POST /sessions/{id}/messages), every primitive in this advisory is reachable from any anonymous TCP client to port 8899. The container has no directive, so successful execution runs as . See GHSA-1 for the shared reproducer environment block — the same setup applies here. The five primitives also share a second exposure: **prompt-injection in any document the LLM agent processes**. If the agent is asked to summarise an uploaded document containing the embedded instruction , the LLM will emit a tool call with the injected command. This means even an authenticated, non-malicious caller using a clean prompt can be turned into an RCE vector by feeding the agent attacker-controlled content (a malicious PDF, web page, or trade journal). > **Note on the placeholder used throughout the per-finding "Steps to observe" blocks below**: replace with the address you reach the docker host on — typically (or ) if you are running the reproducer on the same machine as the container. All commands below assume this substitution. --- ### Finding 6 — High: BashTool passes LLM-emitted command verbatim to subprocess.run(shell=True) with zero filtering - **Severity**: Critical (CVSS v3.1 score 9.0 falls in the 9.0–10.0 Critical band) - **C