Vibe-Trading before version 0.1.10 improperly limits pathname construction in the run_dir function (agent/src/swarm/store.py). It joins a caller-supplied run identifier onto the base runs directory without validating the input, enabling crafted identifiers to traverse directories. This allows reading arbitrary run.json files outside the runs directory and overwriting existing run.json files at those locations. The vulnerability is classified as a path traversal issue with a medium CVSS score of 4.2, indicating limited attack complexity but potential impact on integrity and availability.

An attacker with low privileges and no user interaction can exploit this vulnerability remotely to read arbitrary run.json files outside the intended directory and overwrite existing run.json files. This compromises data integrity and availability of the application. Confidentiality is not impacted according to the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using untrusted input for run identifiers or implement input validation to restrict directory traversal characters. Monitor vendor channels for updates regarding an official patch or mitigation.