CVE-2025-27106 Code injection in binance-trading-bot
Authenticated users can execute arbitrary code on the host via command injection in the restore endpoint of the Binance trading bot.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-27106?
CVE-2025-27106 is a high-severity command injection vulnerability in chrisleekr binance-trading-bot, published on 21 Feb 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
binance-trading-bot is an automated Binance trading bot with trailing buy/sell strategy. Authenticated users of binance-trading-bot can achieve Remote Code Execution on the host system due to a command injection vulnerability in the `/restore` endpoint. The restore endpoint of binance-trading-bot is vulnerable to command injection via the `/restore` endpoint. The name of the uploaded file is passed to shell.exec without sanitization other than path normalization, resulting in Remote Code Execution. This may allow any authorized user to execute code in the context of the host machine. This issue has been addressed in version 0.0.100 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Weakness: CWE-78
Which versions are affected by CVE-2025-27106?
How do I fix CVE-2025-27106?
No fix has been published for CVE-2025-27106 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-27106 being exploited?
There is no known exploitation of CVE-2025-27106 in the wild and no public exploit code.
Sources
Also known as GHSA-wq6j-4388-4gg5.