Threats Tagged 'ghsa-v2f8-6655-7grj'
View all threats tagged with 'ghsa-v2f8-6655-7grj'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'ghsa-v2f8-6655-7grj'
Click on any threat for detailed analysis and mitigation recommendations
Vibe-Trading AI version 0.1.0 through 0.1.6 contains multiple critical security vulnerabilities, including unauthenticated full API exposure and remote code execution (RCE). The primary critical issue allows unauthenticated attackers to execute arbitrary shell commands as root inside the container via the /sessions/{id}/messages endpoint due to missing authentication enforcement when API_AUTH_KEY is unset. Additional findings include authorization gaps, unauthenticated file uploads, permissive CORS configurations, and partial API key disclosure. The Docker container runs as root by default, increasing the impact of exploitation. A patch is available to address these issues. Join the discussion | GCVE Database | 10/02/2026, 22:44:26 UTC Added: 10/03/2026, 17:21:50 UTC |
Showing 1 to 1 of 1 result