Read the docs
TI-2026-78719 Aliases CVE-2026-114106

HKUDS Vibe-Trading Path Traversal Exposes Server Files

Priority MEDIUM 44CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability (CWE-22) that lets remote attackers read sensitive server files through the LLM agent's file-read tools. An attacker can prompt the agent to call read_document, which lacks sandbox checks, or tools gated by safe_user_path, to leak /etc/shadow, /proc/self/environ API keys, and /root credentials.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability that allows remote attackers to read sensitive server files through LLM agent file-read tools. Attackers can prompt the agent to invoke read_document, which lacks sandbox checks, or safe_user_path-gated tools to leak /etc/shadow, /proc/self/environ API keys, and /root credentials.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00432 37th percentileScored 2026-11-07
Fix Fixed Vibe-Trading (HKUDS): 0.1.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
HKUDSVibe-Trading0.1.0 to before 0.1.70.1.7Patch availableCNA
  • Vibe-Trading VendorHKUDS Affected 0.1.0 to before 0.1.7 Fixed in 0.1.7 Patch available CNA

Remediation

Upgrade HKUDS Vibe-Trading to version 0.1.7 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Vibe-Trading (HKUDS) Fixed in 0.1.7

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    HKUDS Vibe-Trading 0.1.7

    3 records Highest priority Priority HIGH 1 HIGH, 2 MEDIUM

    Other records, highest priority first

    • TI-2026-78721 Missing authentication in HKUDS Vibe-Trading FastAPI server enables RCEPriority HIGH 81
    • TI-2026-78720 Indirect prompt injection in HKUDS Vibe-Trading allows remote command executionPriority MEDIUM 40
    Show all 3 records →

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-114106
  2. 2026-10-22 Priority changed: MEDIUM → LOW
  3. 2026-10-28 CISA SSVC decision points changed
  4. 2026-10-28 Priority changed: LOW → MEDIUM

References

Advisory 1

  • TI-2026-44237 LightRAG: Missing Authentication for Critical API Functions in Default Configuration CVSS 3.1CRITICAL 9.8
  • TI-2026-78721 Missing authentication in HKUDS Vibe-Trading FastAPI server enables RCE CVSS 4.0CRITICAL 9.3
  • TI-2026-44184 Improper authentication in HKUDS LightRAG CVSS 4.0CRITICAL 9.3
  • TI-2026-26034 Zero-Click Indirect Prompt Injection and Authentication Bypass via Email Polling CVSS 4.0HIGH 8.9
  • TI-2026-62432 HKUDS nanobot before 0.3.0 Server-Side Request Forgery via WebFetchTool CVSS 4.0CRITICAL 9.2
  • TI-2026-25310 DeepCode 1.2.0 Path Traversal via SPA Catch-All Route in main.py CVSS 4.0HIGH 8.7
See all 47 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences