Description
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because require_auth() returns early when API_AUTH_KEY is unset. Attackers can post messages to /sessions/{id}/messages to trigger root shell commands via BashTool, upload .py or .sh files via /upload, read session histories, and obtain partial API keys.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| HKUDS | Vibe-Trading | 0.1.0 – < 0.1.7 | 0.1.7 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | vibe-trading-ai | >= 0.1.0, < 0.1.7 | 0.1.7 | GHSA-v2f8-6655-7grj |
References
- GitHub Security Advisory (GHSA-v2f8-6655-7grj) vendor-advisory
- VulnCheck Advisory: HKUDS Vibe-Trading before 0.1.7 Missing Authentication in FastAPI Server Enabling RCE third-party-advisory