CVE-2025-27106: Code injection in binance-trading-bot
binance-trading-bot is an automated Binance trading bot with trailing buy/sell strategy. Authenticated users of binance-trading-bot can achieve Remote Code Execution on the host system due to a command injection vulnerability in the /restore endpoint. The restore endpoint of binance-trading-bot is vulnerable to command injection via the /restore endpoint. The name of the uploaded file is passed to shell.exec without sanitization other than path normalization, resulting in Remote Code Execution. This may allow any authorized user to execute code in the context of the host machine. This issue has been addressed in version 0.0.100 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
binance-trading-botto a version that resolves this vulnerability.Fixed in 0.0.100
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27106?
CVE-2025-27106 is classified as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2025-27106?
To mitigate CVE-2025-27106, upgrade the Binance trading-bot to version 0.0.100 or later.
What types of systems are affected by CVE-2025-27106?
CVE-2025-27106 affects systems running the Binance trading-bot version prior to 0.0.100.
What exploit does CVE-2025-27106 enable?
CVE-2025-27106 enables remote code execution through command injection via the /restore endpoint.
Who is at risk from CVE-2025-27106?
Authenticated users of the Binance trading-bot are at risk of CVE-2025-27106.