Threats Tagged 'ghsa-5rmq-chc7-m22f'
View all threats tagged with 'ghsa-5rmq-chc7-m22f'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'ghsa-5rmq-chc7-m22f'
Click on any threat for detailed analysis and mitigation recommendations
Vibe-Trading AI contains two related path traversal vulnerabilities in its file-read tools, allowing unauthenticated users to read arbitrary files within the container's root home (/root) and application directory (/app). The safe_user_path() function incorrectly permits any path under these directories, exposing sensitive files such as SSH keys, AWS credentials, and environment variables. Additionally, the read_document() function lacks sandboxing, enabling reading of any file accessible to the FastAPI process, including critical system files like /etc/shadow. The container runs as root, exacerbating the risk. These vulnerabilities can leak sensitive file contents via error messages when the files are parsed as trade journals. A patch is available to address both issues. Join the discussion | GCVE Database | 10/02/2026, 22:44:12 UTC Added: 10/03/2026, 17:21:50 UTC |
Showing 1 to 1 of 1 result