- Latest release
- 0.1.19 (Nov 5, 2026): no advisory affects it
- Newest unaffected release
- 0.1.19 (Nov 5, 2026), the latest release
- Advisories
- 3 · 1 critical, 2 high
- Weekly downloads
- 2,949
- Dependents
- 0
- Releases
- 20 since 0.1.0 (Mar 31, 2026)
- Registry
- PyPI
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2026-114108Affects 0.1.0 to 0.1.6 (0.1.7 is outside it)
- CVE-2026-114107Affects 0.1.0 to 0.1.6 (0.1.7 is outside it)
- CVE-2026-114106Affects 0.1.0 to 0.1.6 (0.1.7 is outside it)
Advisories 3
- CVE-2026-114108Critical 9.3
HKUDS Vibe-Trading before 0.1.7 Missing Authentication in FastAPI Server Enabling RCE
Affected: from 0.1.0, fixed in 0.1.7.
Fixed in 0.1.7 (released May 6, 2026, 168 days before disclosure).
The latest release, 0.1.19, is not affected.
- CVE-2026-114107High 8.7
HKUDS Vibe-Trading 0.1.0 before 0.1.7 Indirect Prompt Injection RCE via BashTool and BackgroundRunTool
Affected: from 0.1.0, fixed in 0.1.7.
Fixed in 0.1.7 (released May 6, 2026, 168 days before disclosure).
The latest release, 0.1.19, is not affected.
- CVE-2026-114106High 8.7
HKUDS Vibe-Trading 0.1.0 before 0.1.7 Path Traversal via read_document and safe_user_path
Affected: from 0.1.0, fixed in 0.1.7.
Fixed in 0.1.7 (released May 6, 2026, 168 days before disclosure).
The latest release, 0.1.19, is not affected.