---
title: "GHSA-v2f8-6655-7grj: Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain"
url: https://erroneo.us/security/ghsa/GHSA-v2f8-6655-7grj/
description: "GHSA-v2f8-6655-7grj (critical, PyPI): Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain. Summary: 5 findings —…"
type: advisory
section: "Security Digest"
date_published: 2026-10-02
date_modified: 2026-10-02
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-v2f8-6655-7grj"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-v2f8-6655-7grj: Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain

## Affected packages

- PyPI `vibe-trading-ai` >= 0.1.0, < 0.1.7 → fixed: 0.1.7

## Details

Summary: 5 findings — unauthenticated full-API exposure (F1, lead Critical), read-side authorization gap that persists even with APIAUTHKEY set (F2), unauthenticated file write of .py/.sh/.yaml to a server-returned path (F3), default-permissive CORS that combines with a loopback-only check to grant any browser page on whitelisted localhost ports credentialed cross-origin access (F-A4), and partial API-key disclosure via masksecret() (F-A5). --- Shared baseline (applies to all 5 findings) The shipped agent/.env.example line 112 ships # APIAUTHKEY= commented out. requireauth() at agent/apiserver.py line 303 executes if not apikey: return and returns None immediately when APIAUTHKEY is unset, so every endpoint decorated with dependencies=[Depends(requireauth)] operates as unauthenticated. The shipped Dockerfile does not contain a USER directive, so the FastAPI process runs as uid=0(root) inside the container (verified: docker exec id returns uid=0(root) gid=0(root)). The docker-compose.yml binds 0.0.0.0:8899 with no network restriction. The only operator action required beyond a clean install is supplying a working LLM API key so the agent loop can complete its tool-call round trip — this is the normal first step to make the agent functional, not an additional security opt-in. F-A4 and F-A5 do not require an LLM key (see per-finding notes); F1 and F3 do not require an LLM key for the unauth surface itself, only for the chained RCE demonstration in F1. Reproducer environment (common) > Note on the HOST placeholder used throughout the per-finding "Steps to observe" blocks below: replace HOST with the address you reach the docker host on — typically localhost (or 127.0.0.1) if you are running the reproducer on the same machine as the container. All curl commands below assume this substitution. --- Finding 1 — Critical: Unauthenticated network client reaches shell execution via POST /sessions/{id}/messages - Severity: Critical - CVSS v3.1: 9.8 — AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - CVSS v4.0: 10.0 — AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - CWE: CWE-306 (Missing Authentication for Critical Function); chains into CWE-78 (Group B, F6) Affected files: - agent/apiserver.py:303 — if not apikey: return early return in…

## Sources

- [GitHub Advisory GHSA-v2f8-6655-7grj](https://github.com/advisories/GHSA-v2f8-6655-7grj)
- [github.com](https://github.com/HKUDS/Vibe-Trading/security/advisories/GHSA-v2f8-6655-7grj)
- [github.com](https://github.com/HKUDS/Vibe-Trading/commit/9454d4a27a763b80e1d6eb5763b86c88e9e4e714)
- [github.com](https://github.com/HKUDS/Vibe-Trading/releases/tag/v0.1.7)

---
Source page: https://erroneo.us/security/ghsa/GHSA-v2f8-6655-7grj/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt