Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-114106— HKUDS Vibe-Trading 0.1.0 before 0.1.7 Path Traversal via read_document and safe_user_path

Quick assessment

Affected

HKUDS Vibe-Trading

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

HKUDS Vibe-Trading 0.1.0 至 0.1.7 版本（不含 0.1.7）存在路径遍历漏洞，允许远程攻击者通过大语言模型（LLM）代理的文件读取工具读取敏感服务器文件。攻击者可诱导代理调用未实施沙箱检查的函数，或绕过防护机制的工具，从而泄露、中的 API 密钥以及目录下的凭据。

CVSS 7.5 · High Updated Oct 21, 2026

Possible ATT&CK Techniques 3 AI

T1038 T1190 · Exploit Public-Facing Application T1083 · File and Directory Discovery

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

HKUDS Vibe-Trading 0.1.0 before 0.1.7 Path Traversal via read_document and safe_user_path

Source: CVE Program / CVE List V5

Vulnerability Description

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability that allows remote attackers to read sensitive server files through LLM agent file-read tools. Attackers can prompt the agent to invoke read_document, which lacks sandbox checks, or safe_user_path-gated tools to leak /etc/shadow, /proc/self/environ API keys, and /root credentials.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

对路径名的限制不恰当(路径遍历)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
HKUDS	Vibe-Trading	0.1.0 ~ 0.1.7	-

II. Public POCs for CVE-2026-114106

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-114106

请登录查看更多情报信息。

Other References for CVE-2026-114106 (2)

https://github.com/HKUDS/Vibe-Trading/security/advisories/GHSA-5rmq-chc7-m22f vendor-advisory
https://www.vulncheck.com/advisories/hkuds-vibe-trading-0.1.0-before-0.1.7-path-traversal-via-read-document-and-safe-user-path third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-114106

Same Patch Batch · HKUDS · 2026-10-21 · 3 CVEs total

CVE-2026-114108	9.8 CRITICAL	HKUDS Vibe-Trading before 0.1.7 Missing Authentication in FastAPI Server Enabling RCE
CVE-2026-114107	8.8 HIGH	HKUDS Vibe-Trading 0.1.0 before 0.1.7 Indirect Prompt Injection RCE via BashTool and Backg

IV. Related Vulnerabilities

Same product: Vibe-Trading

Same vendor: HKUDS

Same weakness: CWE-22

V. Comments for CVE-2026-114106

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-114106— HKUDS Vibe-Trading 0.1.0 before 0.1.7 Path Traversal via read_document and safe_user_path

Quick assessment

Possible ATT&CK Techniques 3 AI

I. Basic Information for CVE-2026-114106

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-114106

III. Intelligence Information for CVE-2026-114106

Other References for CVE-2026-114106 (2)

Same Patch Batch · HKUDS · 2026-10-21 · 3 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-114106

Leave a comment