CVE-2025-27106

binance-trading-bot is an automated Binance trading bot with trailing buy/sell strategy. Authenticated users of binance-trading-bot can achieve Remote Code Execution on the host system due to a command injection vulnerability in the `/restore` endpoint. The restore endpoint of binance-trading-bot is vulnerable to command injection via the `/restore` endpoint. The name of the uploaded file is passed to shell.exec without sanitization other than path normalization, resulting in Remote Code Execution. This may allow any authorized user to execute code in the context of the host machine. This issue has been addressed in version 0.0.100 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-78

• https://github.com/chrisleekr/binance-trading-bot/blob/dd8e1a91b872a48aec47bbe1280c1c6ea96784d9/app/frontend/webserver/handlers/restore-post.js#L14
• https://github.com/chrisleekr/binance-trading-bot/commit/99d464cf8ef858d441189993054ec5f5f86e6213
• https://github.com/chrisleekr/binance-trading-bot/security/advisories/GHSA-wq6j-4388-4gg5

Published

Feb 21, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-27100lakeFS is an open-source tool that transforms your object st…6.5
• CVE-2025-27101Opal is OBiBa’s core database application for biobanks or ep…7.3
• CVE-2025-27102Agate is central authentication server software for OBiBa ep…5.4
• CVE-2025-27103DataEase is an open source business intelligence and data vi…6.5
• CVE-2025-27104vyper is a Pythonic Smart Contract Language for the EVM. Mul…7.5
• CVE-2025-27105vyper is a Pythonic Smart Contract Language for the EVM. Vyp…9.1
• CVE-2025-27107Integrated Scripting is a tool for creating scripts for hand…8.6
• CVE-2025-27108dom-expressions is a Fine-Grained Runtime for Performant DOM…6.1
• CVE-2025-27109solid-js is a declarative, efficient, and flexible JavaScrip…7.3
• CVE-2025-2711A vulnerability was found in Yonyou UFIDA ERP-NC 5.0. It has…6.1
• CVE-2025-27110Libmodsecurity is one component of the ModSecurity v3 projec…7.5
• CVE-2025-27111Rack is a modular Ruby web server interface. The Rack::Sendf…7.5