Server-side Request Forgery (SSRF) Affecting vibe-trading-ai package, versions [0.1.0,0.1.7)
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-VIBETRADINGAI-21693752
- published24 Oct 2026
- disclosed2 Oct 2026
- creditUnknown
Introduced: 2 Oct 2026
New CVE NOT AVAILABLE CWE-116 (opens in a new tab)How to fix?
Upgrade vibe-trading-ai to version 0.1.7 or higher.
Overview
vibe-trading-ai is a Natural-language finance research AI agent with backtesting
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the API server's unauthenticated access path, which allows a remote attacker to reach sensitive endpoints without a valid API key when API_AUTH_KEY is not configured. In dev mode, the server previously skipped all authentication regardless of the client's origin, permitting any network-reachable client to invoke privileged tool endpoints including shell execution tools. An attacker can exploit this to achieve arbitrary command execution on the host.