All vulnerabilities
CVE-2026-114106GHSA-5rmq-chc7-m22f

HKUDS Vibe-Trading 0.1.0 before 0.1.7 Path Traversal via read_document and safe_user_path

HKUDS Vibe-TradingPyPILibraries & packages
Open in ThreatlineRecord JSON
CVSS
8.7High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.43%Chance of exploitation activity in the next 30 days, higher than 36% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0.1.7Fixed versionCVE List
Published21 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 0.1.7Vibe-TradingCVE List
  • 0.1.7vibe-trading-ai, PyPIOSVpip install "vibe-trading-ai>=0.1.7"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability that allows remote attackers to read sensitive server files through LLM agent file-read tools. Attackers can prompt the agent to invoke read_document, which lacks sandbox checks, or safe_user_path-gated tools to leak /etc/shadow, /proc/self/environ API keys, and /root credentials.

Text from CVE List

Affected versions 10

  • Vibe-Tradingaffected: 0.1.0 before 0.1.7CVE List
  • Vibe-Tradingunaffected: 0.1.7CVE List
  • vibe-trading-ai, PyPIfrom 0.1.0, fixed in 0.1.7OSV
  • vibe-trading-ai, PyPI0.1.0OSV
  • vibe-trading-ai, PyPI0.1.1OSV
  • vibe-trading-ai, PyPI0.1.2OSV
  • vibe-trading-ai, PyPI0.1.3OSV
  • vibe-trading-ai, PyPI0.1.4OSV
  • vibe-trading-ai, PyPI0.1.5OSV
  • vibe-trading-ai, PyPI0.1.6OSV

References 2