CVE-2025-27106: Code injection in binance-trading-bot
First published: Fri Feb 21 2025(Updated: )
binance-trading-bot is an automated Binance trading bot with trailing buy/sell strategy. Authenticated users of binance-trading-bot can achieve Remote Code Execution on the host system due to a command injection vulnerability in the `/restore` endpoint. The restore endpoint of binance-trading-bot is vulnerable to command injection via the `/restore` endpoint. The name of the uploaded file is passed to shell.exec without sanitization other than path normalization, resulting in Remote Code Execution. This may allow any authorized user to execute code in the context of the host machine. This issue has been addressed in version 0.0.100 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Binance Trading Bot | <0.0.100 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/chrisleekr/binance-trading-bot/security/advisories/GHSA-wq6j-4388-4gg5
- https://github.com/chrisleekr/binance-trading-bot/commit/99d464cf8ef858d441189993054ec5f5f86e6213
- https://github.com/chrisleekr/binance-trading-bot/blob/dd8e1a91b872a48aec47bbe1280c1c6ea96784d9/app/frontend/webserver/handlers/restore-post.js#L14
Frequently Asked Questions
What is the severity of CVE-2025-27106?
CVE-2025-27106 is classified as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2025-27106?
To mitigate CVE-2025-27106, upgrade the Binance trading-bot to version 0.0.100 or later.
What types of systems are affected by CVE-2025-27106?
CVE-2025-27106 affects systems running the Binance trading-bot version prior to 0.0.100.
What exploit does CVE-2025-27106 enable?
CVE-2025-27106 enables remote code execution through command injection via the /restore endpoint.
Who is at risk from CVE-2025-27106?
Authenticated users of the Binance trading-bot are at risk of CVE-2025-27106.
- agent/title
- agent/references
- agent/weakness
- agent/type
- agent/description
- agent/first-publish-date
- agent/author
- collector/nvd-api
- source/NVD
- agent/severity
- agent/last-modified-date
- agent/event
- agent/softwarecombine
- agent/source
- agent/tags
- collector/mitre-cve
- source/MITRE
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/binance
- canonical/binance trading bot