Read the docs
TI-2026-41888 Aliases CVE-2026-58170GHSA-h9xw-f6mh-953j

Vibe-Trading < 0.1.10 - Path Traversal in Proposal Identifier Allows Forging Live Trading Mandates

Priority HIGH 65CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Vibe-Trading before 0.1.10 builds the proposal file path by joining a caller-supplied proposal identifier onto the broker proposals directory without sanitization (agent/src/live/mandate/commit.py). A proposal identifier containing path traversal sequences causes the application to load an attacker-controlled JSON file as an authoritative live trading mandate. Combined with the file upload endpoint, an admitted caller can write a JSON file to a known location and traverse to it, and because the ceilings validation is skipped when ceilings are absent, the attacker fully controls the committed mandate.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00554 46th percentileScored 2026-11-07
Fix Fixed Vibe-Trading (HKUDS): 0.1.10

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
HKUDSVibe-Tradingbefore 0.1.100.1.10Patch availableCNA
  • Vibe-Trading VendorHKUDS Affected before 0.1.10 Fixed in 0.1.10 Patch available CNA

Remediation

  • Fix · CNA Vibe-Trading (HKUDS) Fixed in 0.1.10

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    HKUDS Vibe-Trading 0.1.10

    4 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-41891 Vibe-Trading < 0.1.10 - Path Traversal via Persistent Memory TypePriority MEDIUM 60
    • TI-2026-41887 Origin validation error in HKUDS Vibe-TradingPriority LOW 36
    • TI-2026-41889 Vibe-Trading < 0.1.10 - Path Traversal via Swarm Run IdentifierPriority LOW 12
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-58170
  2. 2026-10-03 Alias added: GHSA-h9xw-f6mh-953j

References

Patch 2

Other 1

  • TI-2026-44237 LightRAG: Missing Authentication for Critical API Functions in Default Configuration CVSS 3.1CRITICAL 9.8
  • TI-2026-78721 Missing authentication in HKUDS Vibe-Trading FastAPI server enables RCE CVSS 4.0CRITICAL 9.3
  • TI-2026-44184 Improper authentication in HKUDS LightRAG CVSS 4.0CRITICAL 9.3
  • TI-2026-26034 Zero-Click Indirect Prompt Injection and Authentication Bypass via Email Polling CVSS 4.0HIGH 8.9
  • TI-2026-62432 HKUDS nanobot before 0.3.0 Server-Side Request Forgery via WebFetchTool CVSS 4.0CRITICAL 9.2
  • TI-2026-25310 DeepCode 1.2.0 Path Traversal via SPA Catch-All Route in main.py CVSS 4.0HIGH 8.7
See all 47 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences