Five LLM-callable tools in Vibe-Trading disclosed with command execution, code injection, and SSRF vulnerabilities(original, opens in a new tab)
A GitHub security advisory discloses that five LLM-callable tools in Vibe-Trading have command execution, code injection, and SSRF vulnerabilities, with BashTool and BackgroundRunTool both scoring 9.0 on CVSS v3.1. These tools are unconditionally registered into the auto-discovered tool registry under default configuration, the LLM can call them freely, and the container does not set a USER directive, so successful execution runs as uid=0 (root). BashTool passes LLM-generated commands verbatim to subprocess.run(shell=True) with no allowlist, escaping, or length limits; BackgroundRunTool executes the same kind of commands asynchronously, making execution harder to discover in access logs. The advisory also notes that even if the unauthenticated interface is fixed, attackers can still perform prompt injection on the Agent through malicious documents, turning legitimate callers into RCE channels.