Threat Intelligence Database

HKUDS Vibe-Trading versions from 0.1.0 up to but not including 0.1.7 have a missing authentication vulnerability. This flaw allows unauthenticated attackers to access critical API endpoints because the require_auth() function returns early if the API_AUTH_KEY is not set. Exploitation enables attackers to execute root shell commands, upload malicious scripts, read session histories, and obtain partial API keys. The vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity.

HKUDS Vibe-Trading versions from 0.1.0 up to but not including 0.1.7 contain an indirect prompt injection vulnerability. This flaw allows remote attackers to execute arbitrary shell commands as root by embedding malicious instructions in documents or web pages processed by the agent. The vulnerability arises because BashTool and BackgroundRunTool execute model-generated commands using subprocess.run with shell=True without any allow-list or approval mechanism. Additionally, the read_url function can fetch arbitrary URLs, enabling server-side request forgery. The vulnerability has a high severity rating with a CVSS score of 8.7.

HKUDS Vibe-Trading versions from 0.1.0 up to but not including 0.1.7 contain a path traversal vulnerability. This flaw allows remote attackers to read sensitive server files by exploiting LLM agent file-read tools that lack proper sandboxing. Attackers can use the read_document function or safe_user_path-gated tools to access critical files such as /etc/shadow, /proc/self/environ, and /root credentials. The vulnerability has a high severity with a CVSS score of 8.7.

Vibe-Trading before 0.1.10 contains a path traversal vulnerability that allows attackers to write files outside the intended memory root directory by supplying a malicious memory_type value containing path traversal sequences through the remember tool. Attackers can manipulate the memory_type parameter in the persistent memory store to cause the application to write arbitrary Markdown files to unintended locations on the filesystem.

Vibe-Trading before 0.1.10 constructs the swarm run directory by joining a caller-supplied run identifier onto the runs base directory without validation in run_dir (agent/src/swarm/store.py). A crafted run identifier supplied through the MCP swarm tools causes the application to read arbitrary run.json files outside the runs directory and to overwrite existing run.json files at traversed locations.

Vibe-Trading before 0.1.10 builds the proposal file path by joining a caller-supplied proposal identifier onto the broker proposals directory without sanitization (agent/src/live/mandate/commit.py). A proposal identifier containing path traversal sequences causes the application to load an attacker-controlled JSON file as an authoritative live trading mandate. Combined with the file upload endpoint, an admitted caller can write a JSON file to a known location and traverse to it, and because the ceilings validation is skipped when ceilings are absent, the attacker fully controls the committed mandate.

Vibe-Trading before 0.1.10 contains a DNS rebinding authentication bypass vulnerability that allows remote attackers to bypass bearer-token authentication by exploiting the server's trust of TCP peer addresses for loopback clients combined with missing Host header validation while binding to 0.0.0.0 with credentialed CORS. Attackers can craft a malicious DNS rebinding page to issue authenticated requests to the local API server, reach the shell execution endpoint with a bash-enabled preset, and achieve remote code execution as the API process user while also overwriting LLM and data-source settings to exfiltrate credentials.