# Vibe-Trading LLM-callable tools permit command execution, code injection, SSRF

Source: https://junglewise.ai/threats/vibe-trading-llm-callable-tools-permit-command-execution-code-injection-a9ebf182  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-02. Updated: 2026-10-02  
License: CC BY 4.0 with a link back

Severity: critical · CVSS 10 · Published 2026-10-02

Vibe-Trading is an AI-powered trading analysis platform that allows a large language model to call various tools to execute commands, read web pages, and run backtests. The platform exposes five critical vulnerabilities: two tools (BashTool and BackgroundRunTool) execute arbitrary shell commands without filtering, a backtest runner loads and executes Python code before validating it, a web-reading tool forwards URLs to external services without validation enabling internal network scanning, and template rendering lacks proper escaping. An unauthenticated attacker can exploit these to gain remote code execution as root, exfiltrate internal network data, or inject malicious code through document uploads.

Technologies: [vibe-trading-ai (PyPI)](https://junglewise.ai/threats/technologies/vibe-trading-ai). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Critical severity, with a CVSS score of 10, published 2 October 2026.

**Which products and versions are affected?** vibe-trading-ai (PyPI) >= 0.1.0, < 0.1.7; Vibe-Trading all versions prior to patch.

**Is there a fix for This vulnerability?** Yes: fixed in <UNKNOWN>. Until then: Disable or gate BashTool and BackgroundRunTool behind an explicit opt-in environment variable (e.g., ENABLE_BASH_TOOL=1). For backtest runner, validate Python source with ast.parse() before exec_module() and reject non-import/non-class/non-function top-level statements. For WebReaderTool, enforce urlparse().scheme in ("http", "https"), reject RFC1918/loopback addresses, and cap URL length. For codegen, enable autoescape for all extensions or apply |tojson filters to all template variables. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a web application.

**Am I affected?** Check whether you run vibe-trading-ai (PyPI) or Vibe-Trading at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in <UNKNOWN>

Disable or gate BashTool and BackgroundRunTool behind an explicit opt-in environment variable (e.g., ENABLE_BASH_TOOL=1). For backtest runner, validate Python source with ast.parse() before exec_module() and reject non-import/non-class/non-function top-level statements. For WebReaderTool, enforce urlparse().scheme in ("http", "https"), reject RFC1918/loopback addresses, and cap URL length. For codegen, enable autoescape for all extensions or apply |tojson filters to all template variables.

## Technical details

The advisory describes five distinct vulnerabilities in the LLM agent tool registry. BashTool (F6) and BackgroundRunTool (F7) pass LLM-emitted shell commands directly to subprocess.run(shell=True) with zero input validation, allowing arbitrary command injection. The backtest runner (F8) executes exec_module() on user-supplied Python files before validating the SignalEngine class, enabling top-level code execution. WebReaderTool (F-B4) forwards LLM-supplied URLs to Jina without schema/hostname validation, enabling SSRF. Jinja2 codegen (F-B5) disables autoescape for .py.j2 templates, allowing string-interpolation code injection into generated signal_engine.py. All five tools are auto-discovered by the LLM at startup with no opt-in gate; combined with unauthenticated session creation (GHSA-1), every primitive is reachable from any anonymous TCP client. Prompt injection in uploaded documents can trigger any of these paths.

## Affected products

- Vibe-Trading Vibe-Trading all versions prior to patch

## Timeline

- 2026-10-02: disclosed: Advisory GHSA-jqmf-mx4f-hfr6 published

## Related threats

- [Vibe-Trading FastAPI unauthenticated access and RCE chain](https://junglewise.ai/threats/vibe-trading-fastapi-endpoints-permit-unauthenticated-access-file-1d82990e)
- [Vibe-Trading file-read tools arbitrary file disclosure](https://junglewise.ai/threats/vibe-trading-file-read-tools-expose-arbitrary-server-readable-files-bc954976)