{"vulnerability": "GHSA-5RMQ-CHC7-M22F", "sightings": [{"uuid": "5842e3e5-5ebb-4513-8ab5-5164c6b81eae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-5RMQ-CHC7-M22F", "type": "seen", "source": "https://gist.github.com/alon710/0408aa792dad6255ca8d214afd450d6a", "content": "# GHSA-5RMQ-CHC7-M22F: GHSA-5RMQ-CHC7-M22F: Arbitrary File Read and Path Traversal in Vibe-Trading Platform\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-10-02\n> **Full Report:** https://cvereports.com/reports/GHSA-5RMQ-CHC7-M22F\n\n## Summary\nAn arbitrary file read and path traversal vulnerability in the Vibe-Trading platform allows unauthenticated remote attackers to retrieve sensitive configuration files, API keys, and system secrets. The flaw stems from permissive directory checking in path validation tools and a complete lack of input sanitization in the document reader utility. Remediation was introduced in version 0.1.7 by implementing strict path allowlists, forcing user authentication, and dropping root execution privileges within the container environment.\n\n## TL;DR\nThe Vibe-Trading platform before version 0.1.7 exposes arbitrary server-readable files to unauthenticated remote attackers because of loose path validation and unauthenticated API endpoints running with root privileges.\n\n## Technical Details\n\n- **CWE ID**: CWE-22, CWE-23, CWE-200, CWE-552\n- **Attack Vector**: Network\n- **CVSS Score**: 7.5\n- **EPSS Score**: Not applicable\n- **Impact**: High Confidentiality Loss\n- **Exploit Status**: Proof-of-Concept Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Vibe-Trading Platform\n- vibe-trading-ai Python package\n- **vibe-trading-ai**: >= 0.1.0, < 0.1.7 (Fixed in: `0.1.7`)\n\n## Mitigation\n\n- Upgrade vibe-trading-ai to version 0.1.7 or higher\n- Configure the application process to run as a non-privileged user\n- Apply network access control lists to restrict access to port 8899\n\n**Remediation Steps:**\n1. Pull the updated source code or update via pip: pip install vibe-trading-ai>=0.1.7\n2. Rebuild the associated Docker containers to adopt the non-root user configuration\n3. Restart the server and verify that session endpoints require authentication\n\n## References\n\n- [GitHub Security Advisory GHSA-5rmq-chc7-m22f](https://github.com/HKUDS/Vibe-Trading/security/advisories/GHSA-5rmq-chc7-m22f)\n- [Remediation Commit](https://github.com/HKUDS/Vibe-Trading/commit/9454d4a27a763b80e1d6eb5763b86c88e9e4e714)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-5RMQ-CHC7-M22F) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-03T14:30:28.000000Z"}]}