CVE-2026-114107— HKUDS Vibe-Trading 0.1.0 before 0.1.7 Indirect Prompt Injection RCE via BashTool and BackgroundRunTool
Quick assessment
Affected
HKUDS Vibe-Trading
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
HKUDS Vibe-Trading 在 0.1.0 至 0.1.7 之前的版本中存在间接提示注入漏洞。该漏洞允许远程攻击者通过在代理处理的文档或网页中植入指令，以 root 用户身份执行 shell 命令。具体而言，BashTool 和 BackgroundRunTool 将模型生成的命令直接传递给 subprocess.run，且启用了 shell=True 参数，同时缺乏白名单或审批机制；此外，read_url 函数可获取任意 URL，从而导致命令执行和服务器端请求伪造（SSRF）风险。
Possible ATT&CK Techniques 3 AI
T1071.001 · Web Protocols T1059.004 · Unix Shell T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-114107
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
HKUDS Vibe-Trading 0.1.0 before 0.1.7 Indirect Prompt Injection RCE via BashTool and BackgroundRunTool
Source: CVE Program / CVE List V5
Vulnerability Description
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as root by planting instructions in documents or web pages the agent processes. BashTool and BackgroundRunTool pass model-emitted commands to subprocess.run with shell=True and no allow-list or approval step, and read_url fetches arbitrary URLs, enabling command execution and server-side request forgery.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1427
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| HKUDS | Vibe-Trading | 0.1.0 ~ 0.1.7 | - |
|
II. Public POCs for CVE-2026-114107
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-114107
请登录查看更多情报信息。
Other References for CVE-2026-114107 (2)
Same Patch Batch · HKUDS · 2026-10-21 · 3 CVEs total
| CVE-2026-114108 | 9.8 CRITICAL | HKUDS Vibe-Trading before 0.1.7 Missing Authentication in FastAPI Server Enabling RCE |
| CVE-2026-114106 | 7.5 HIGH | HKUDS Vibe-Trading 0.1.0 before 0.1.7 Path Traversal via read_document and safe_user_path |
IV. Related Vulnerabilities
Same product: Vibe-Trading
-
CVE-2026-114108
HKUDS Vibe-Trading before 0.1.7 Missing Authentication in Fa -
CVE-2026-114106
HKUDS Vibe-Trading 0.1.0 before 0.1.7 Path Traversal via rea -
CVE-2026-58173
Vibe-Trading < 0.1.10 - Path Traversal via Persistent Memory -
CVE-2026-58171
Vibe-Trading < 0.1.10 - Path Traversal via Swarm Run Identif -
CVE-2026-58170
Vibe-Trading < 0.1.10 - Path Traversal in Proposal Identifie
Same vendor: HKUDS
-
CVE-2026-114108
HKUDS Vibe-Trading before 0.1.7 Missing Authentication in Fa -
CVE-2026-114106
HKUDS Vibe-Trading 0.1.0 before 0.1.7 Path Traversal via rea -
CVE-2026-102874
HKUDS AnyTool Execute Endpoint main.py subprocess.run os com -
CVE-2026-86062
LightRAG: Stored Cross-Site Scripting (XSS) in the LightRAG -
CVE-2026-85740
LightRAG: SSRF via IPv6-transition address bypass (NAT64, IP
Same weakness: CWE-1427
-
CVE-2026-109440
LangAlpha through 2026.09.07 Indirect Prompt Injection RCE v -
CVE-2026-77931
MoviePilot 3.1.5 Command Injection via ExecuteCommandTool -
CVE-2026-96893
Improper Neutralization of Input Used for LLM Prompting in G -
CVE-2026-70331
Microsoft Edge for iOS Spoofing Vulnerability -
CVE-2026-78379
Consent bypass in python_repl tool via batch kwargs forwardi
V. Comments for CVE-2026-114107
No comments yet