The Vibe trading AI platform includes five critical security flaws in its LLM-callable tools, notably the BashTool which passes LLM-generated commands directly to subprocess.run with shell=True and no filtering, enabling remote code execution as root. Other tools exhibit similar unsafe command execution or SSRF due to lack of input validation. These tools are automatically registered and callable by the LLM agent without operator consent. Combined with an unauthenticated POST API endpoint, these flaws allow any anonymous TCP client to achieve root-level RCE. Additionally, prompt injection attacks can cause the LLM to execute attacker-controlled shell commands embedded in documents it processes. The vulnerabilities affect versions >=0.1.0 and <0.1.7. The CVSS v3.1 score is 9.0 (critical). A patch is available.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary shell commands as root on the host running the Vibe trading AI container. This includes full system compromise, data access, and potential lateral movement. The vulnerabilities also enable server-side request forgery (SSRF) and code injection via Jinja2 templates with disabled autoescape. The lack of filtering or validation means attackers can bypass intended usage restrictions and leverage prompt injection to escalate privileges even from authenticated users. The combined effect is a critical security risk with complete system control.

A patch is available to address these vulnerabilities. Operators should apply the official fix promptly. The vendor advisory confirms patch availability. Until patched, restrict network access to port 8899 to trusted clients only and disable or restrict LLM tool registration if possible. Avoid processing untrusted documents that could contain prompt injection payloads. Do not rely on the LLM's internal judgment to filter commands. Follow the vendor advisory for detailed remediation steps.