Two vulnerabilities affect Vibe-Trading AI's file-read tools: (1) safe_user_path() accepts any path under Path.home() or Path.cwd(), which resolve to /root and /app in the container, allowing reading of sensitive files including SSH keys and credentials. (2) read_document() lacks any sandboxing and returns full content of any readable file, including system secrets. The container runs the FastAPI process as root, increasing exposure. These flaws enable unauthenticated TCP clients on port 8899 to instruct the LLM to read arbitrary files, leaking contents via parse-error messages. Both issues require separate patches due to different code scopes.

An unauthenticated attacker can read arbitrary files within the container's /root and /app directories, including sensitive credentials and secrets such as SSH private keys, AWS credentials, Kubernetes config, and environment variables. The FastAPI process runs as root, so any file readable by root is exposed. The vulnerabilities allow leaking file contents through error messages when files are parsed as trade journals. This leads to high confidentiality impact without requiring authentication or user interaction.

A patch is available to fix both vulnerabilities: one to restrict safe_user_path() to a proper safe envelope and another to add sandboxing in read_document(). Users should apply the official fixes promptly. Since the container runs as root, it is also recommended to run the service under a non-root user to reduce risk. Until patched, avoid exposing the service to untrusted networks. Check the vendor advisory for the latest remediation details.