Cases / REG-0038
Vibe-Trading: instructions planted in documents or web pages the agent processes can make it run shell commands as root, because its BashTool and BackgroundRunTool pass model-emitted commands to the shell with no allow-list or approval step; patched in 0.1.7 (released 6 May 2026), the maintainer's advisory for the shell flaw published 29 July 2026 and CVE (Common Vulnerabilities and Exposures) records 21 October 2026
Caught first by researchersSoftware agents · Shopping, trading and paymentsMachine acts aloneDemonstrationProvisional: awaiting independent corroboration
What happened
not evidenced in source. HKUDS Vibe-Trading from 0.1.0 before 0.1.7 (PyPI package vibe-trading-ai), an LLM agent whose auto-discovered tool registry includes BashTool, BackgroundRunTool, read_document and read_url. Instructions planted by a remote attacker in documents or web pages the agent processes (indirect prompt injection); the repository advisory also describes direct prompts from any anonymous client when API_AUTH_KEY is left unset, as the shipped example configuration leaves it. Per the repository advisory, an instruction embedded in an uploaded document is expected to lead the model to emit a tool call carrying the planted command; the advisory gives this as a reproduction step and does not report its result. It states that the LLM's (large language model's) own judgement is the only barrier and that this barrier collapses under prompt injection. BashTool and BackgroundRunTool pass model-emitted commands to subprocess.run with shell=True and no allow-list or approval step; read_document lacks sandbox checks; the tools are registered by default with no operator opt-in; the shipped container has no USER directive, so the process runs as root. The agent executes shell commands as root; through its file-read tools it can return /etc/shadow, API keys in /proc/self/environ and /root credentials; read_url fetches arbitrary URLs (server-side request forgery). Outcome: averted by disclosure; none reported (severity scores, CVSS (Common Vulnerability Scoring System), differ by who assigned them: VulnCheck, the CVE Numbering Authority, scores CVE-2026-114107 at CVSS 3.1 8.8, shown unchanged in the NVD (National Vulnerability Database) record, which NVD has not yet analysed; the GitHub-reviewed repository advisory is headed CVSS 3.1 10.0, while its BashTool and BackgroundRunTool findings state 9.0 for the same vector); as of Oct 2026. not evidenced in source.
Useful for a decision you face in the next 90 days?1 = not at all, 5 = I'd use it in that decision. One tap; it's saved with your reading code, not your name.
What helped more?
Would you forward this to your team?
Verification: 5 of 6 checks complete
✓ Structured and checkedevery claim typed and sourced, then checked by the Register's automated checker for missing sources and mistyped claims
✓ Sources linked8 of 8 sources link to the record (8 to a primary record)
✓ Sources checked claim by claimevery claim checked against its source on 2026-10-21
✓ Interpretation checked statement by statementeach statement of the Register's interpretation checked against a source on 2026-10-22
○ Reviewed by the editornot yet reviewed by a person
✓ Reply offeredHKUDS: offered
Corrections · 16, latest 2026-10-21
Changes to what this case says, with the reason. Every earlier version is kept.
- 2026-10-21: Sources: ghsa-jqmf. Found in the editor's checks of the interpretations, 21 october 2026: the repository advisory page reads 'warren618 published ghsa-jqmf-mx4f-hfr6 jul 29, 2026'; 2 october 2026 is the github advisory database entry date.
Show the change
Before: {"date": "2026-10-02", "title": "HKUDS/Vibe-Trading repository security advisory GHSA-jqmf-mx4f-hfr6: LLM-callable tools permit command execution, code injection, and SSRF; affects 0.1.0 to before 0.1.7, fixed in 0.1.7 (GitHub-reviewed; read as mirrored at api.osv.dev/v1/vulns/GHSA-jqmf-mx4f-hfr6)"}After: {"date": "2026-07-29", "title": "HKUDS/Vibe-Trading repository security advisory GHSA-jqmf-mx4f-hfr6: LLM-callable tools permit command execution, code injection, and SSRF; affects 0.1.0 to before 0.1.7, fixed in 0.1.7 (published by the maintainers 29 July 2026; entered in the GitHub Advisory Database 2 October 2026; read on github.com and as mirrored by OSV)"} - 2026-10-21: Sources: ghsa-v2f8: title. Found in the editor's checks of the interpretations, 21 october 2026: the 2 october 2026 date is the github advisory database entry; the repository page for ghsa-jqmf shows an earlier publication date (29 july 2026), and this advisory's page was not read.
Show the change
Before: HKUDS/Vibe-Trading repository security advisory GHSA-v2f8-6655-7grj: FastAPI endpoints permit unauthenticated access when API_AUTH_KEY is unset, file upload, and an RCE chain (read as mirrored at api.osv.dev/v1/vulns/GHSA-v2f8-6655-7grj)After: HKUDS/Vibe-Trading repository security advisory GHSA-v2f8-6655-7grj: FastAPI endpoints permit unauthenticated access when API_AUTH_KEY is unset, file upload, and an RCE chain (read as mirrored at api.osv.dev/v1/vulns/GHSA-v2f8-6655-7grj) (date shown is the GitHub Advisory Database entry; the repository page's own publication date was not read) - 2026-10-21: Sources: ghsa-5rmq: title. Found in the editor's checks of the interpretations, 21 october 2026: the 2 october 2026 date is the github advisory database entry; the repository page for ghsa-jqmf shows an earlier publication date (29 july 2026), and this advisory's page was not read.
Show the change
Before: HKUDS/Vibe-Trading repository security advisory GHSA-5rmq-chc7-m22f: file-read tools expose arbitrary server-readable files; container runs as root (read as mirrored at api.osv.dev/v1/vulns/GHSA-5rmq-chc7-m22f)After: HKUDS/Vibe-Trading repository security advisory GHSA-5rmq-chc7-m22f: file-read tools expose arbitrary server-readable files; container runs as root (read as mirrored at api.osv.dev/v1/vulns/GHSA-5rmq-chc7-m22f) (date shown is the GitHub Advisory Database entry; the repository page's own publication date was not read) - 2026-10-21: Fields: recovery technical. Found in the editor's second, independent check of the interpretations, 21 october 2026: the advisory page shows publication on 29 july 2026; 2 october 2026 is the database entry date.
Show the change
Before: The CVE records and the repository advisories list 0.1.7 as the first unaffected version. The advisories list commit 9454d4a and the v0.1.7 release page among their references but do not mention the commit, version 0.1.7 or a patch in their text; the commit was not opened, so what the fix changes is not shown in the sources read. The project's release list and PyPI date 0.1.7 to 6 May 2026, about five months before the repository advisories were published (2 October 2026) and the CVE records (21 October 2026); the advisories' runtime probes were run on version 0.1.6 plus one frontend fix. The advisory's suggested remediation is to remove shell=True and add an allow-list, or to require an explicit operator opt-in for BashToolAfter: The CVE records and the repository advisories list 0.1.7 as the first unaffected version. The advisories list commit 9454d4a and the v0.1.7 release page among their references but do not mention the commit, version 0.1.7 or a patch in their text; the commit was not opened, so what the fix changes is not shown in the sources read. The project's release list and PyPI date 0.1.7 to 6 May 2026, about twelve weeks before the maintainer's advisory for the shell flaw was published (29 July 2026; the GitHub Advisory Database entries are dated 2 October 2026) and about five and a half months before the CVE records (21 October 2026); the advisories' runtime probes were run on version 0.1.6 plus one frontend fix. The advisory's suggested remediation is to remove shell=True and add an allow-list, or to require an explicit operator opt-in for BashTool - 2026-10-21: Fields: evidence event. Found in the editor's second, independent check of the interpretations, 21 october 2026: the advisory page shows publication on 29 july 2026; 2 october 2026 is the database entry date (osv, gitlab).
Show the change
Before: CVE-2026-114107 (shell execution), CVE-2026-114106 (file read) and CVE-2026-114108 (missing authentication) were assigned and published on 21 October 2026 (UTC) by VulnCheck, acting as CVE Numbering Authority; NVD lists CVE-2026-114107 with status Received, meaning NVD has not analysed or scored it. Severity scores (CVSS) differ by who assigned them: VulnCheck scores CVE-2026-114107 at CVSS 3.1 8.8 (user interaction required) and CVSS 4.0 8.7, the scores shown in NVD; the repository advisory GHSA-jqmf-mx4f-hfr6, published 2 October 2026 and reviewed by GitHub, is headed CVSS 3.1 10.0, and its BashTool and BackgroundRunTool findings state CVSS 3.1 9.0 (no user interaction) and CVSS 4.0 9.3, although GitHub's headline score for the vector they give is 10.0. VulnCheck scores CVE-2026-114106 at CVSS 3.1 7.5 and CVSS 4.0 8.7, and CVE-2026-114108 at CVSS 3.1 9.8 and CVSS 4.0 9.3After: CVE-2026-114107 (shell execution), CVE-2026-114106 (file read) and CVE-2026-114108 (missing authentication) were assigned and published on 21 October 2026 (UTC) by VulnCheck, acting as CVE Numbering Authority; NVD lists CVE-2026-114107 with status Received, meaning NVD has not analysed or scored it. Severity scores (CVSS) differ by who assigned them: VulnCheck scores CVE-2026-114107 at CVSS 3.1 8.8 (user interaction required) and CVSS 4.0 8.7, the scores shown in NVD; the repository advisory GHSA-jqmf-mx4f-hfr6, published by the maintainers on 29 July 2026 and entered in the GitHub Advisory Database on 2 October 2026, is headed CVSS 3.1 10.0, and its BashTool and BackgroundRunTool findings state CVSS 3.1 9.0 (no user interaction) and CVSS 4.0 9.3, although GitHub's headline score for the vector they give is 10.0. VulnCheck scores CVE-2026-114106 at CVSS 3.1 7.5 and CVSS 4.0 8.7, and CVE-2026-114108 at CVSS 3.1 9.8 and CVSS 4.0 9.3 - 2026-10-21: Title. Found in the editor's second, independent check of the interpretations, 21 october 2026: the repository advisory page reads 'warren618 published ghsa-jqmf-mx4f-hfr6 jul 29, 2026' (read by the editor's session through the fetch tool, 21 october 2026), matching the cve record's datepublic of 2026-07-29; 2 october 2026 is the date of the github advisory database entry, not of the advisory.
Show the change
Before: Vibe-Trading: instructions planted in documents or web pages the agent processes can make it run shell commands as root, because its BashTool and BackgroundRunTool pass model-emitted commands to the shell with no allow-list or approval step; patched in 0.1.7 (released 6 May 2026), advisories published 2 October 2026 and CVE (Common Vulnerabilities and Exposures) records 21 October 2026After: Vibe-Trading: instructions planted in documents or web pages the agent processes can make it run shell commands as root, because its BashTool and BackgroundRunTool pass model-emitted commands to the shell with no allow-list or approval step; patched in 0.1.7 (released 6 May 2026), the maintainer's advisory for the shell flaw published 29 July 2026 and CVE (Common Vulnerabilities and Exposures) records 21 October 2026 - 2026-10-21: Inference: value. Found in the editor's second, independent check of the interpretations, 21 october 2026: interpretation check, round 2 (rule 20): the cve record states the route as a capability ('allows remote attackers to execute shell commands as root by planting instructions', cve-2026-114107), while the advisory gives it as 'steps to observe' with no reported result (ghsa-jqmf-mx4f-hfr6).
Show the change
Before: The records show nothing between text the agent read and a root shell except the model's own judgement; they give the route from a planted instruction to a shell command as reproduction steps without a reported result, and do not show that any running deployment was exploitedAfter: The records show nothing between text the agent read and a root shell except the model's own judgement; they state the route from a planted instruction to a shell command as a capability, with reproduction steps but no reported result, and do not show that any running deployment was exploited - 2026-10-21: Controls: c-i1. Found in the editor's source check of 21 october 2026: ghsa-jqmf-mx4f-hfr6 (osv.dev copy) phrases the uploaded-document case as 'observe the agent emit a bash tool call for the injected command' under 'steps to observe', not as a reported observation; the failure rests on the cve-2026-114107 record's and the advisory's statements. confidence left at medium.
Show the change
Before: Mechanism: the record names instructions planted in documents or web pages the agent processes as the route to shell execution. Why it interrupts: if processed content were treated only as data, the planted instruction would not become a BashTool or BackgroundRunTool call. Source shows it failed: the advisory describes the agent emitting a bash tool call for an instruction embedded in an uploaded documentAfter: Mechanism: the record names instructions planted in documents or web pages the agent processes as the route to shell execution. Why it interrupts: if processed content were treated only as data, the planted instruction would not become a BashTool or BackgroundRunTool call. Source shows it failed: the CVE record states that planted instructions allow command execution as root, and the advisory states the model's judgement collapses under prompt injection; the advisory gives the uploaded-document case as a reproduction step and does not report its result - 2026-10-21: Inference: value. Found in the editor's source check of 21 october 2026: ghsa-jqmf-mx4f-hfr6 and ghsa-v2f8-6655-7grj (osv.dev copies) give the injected-document and unauthenticated-message chains only as steps to observe, with no recorded result, so the interpretation now also says what the record does not show. the interpretation was not signed (signed_by null), so no signature was cleared; it needs a fresh statement-by-statement check before signing.
Show the change
Before: The records show nothing between text the agent read and a root shell except the model's own judgement; they do not show that any running deployment was exploitedAfter: The records show nothing between text the agent read and a root shell except the model's own judgement; they give the route from a planted instruction to a shell command as reproduction steps without a reported result, and do not show that any running deployment was exploited - 2026-10-21: Fields: recovery technical. Found in the editor's source check of 21 october 2026: ghsa-jqmf-mx4f-hfr6 (osv.dev copy) lists commit 9454d4a27a763b80e1d6eb5763b86c88e9e4e714 and releases/tag/v0.1.7 only as references; its text does not mention the commit, 0.1.7 or a patch, so 'fix commit' was an inference. the commit page could not be opened in this check either. the project's github release list (read via releasealert.dev) gives 'v0.1.7 may 6, 2026', before the advisories' 2 october 2026 publication; ghsa-v2f8-6655-7grj's reproducer is 'v0.1.6 + 1 frontend fix'. gh-rel and ghsa-v2f8 added as sources.
Show the change
Before: {"value": "The NVD records and the repository advisories list 0.1.7 as the first unaffected version, and the advisories reference fix commit 9454d4a; PyPI lists 0.1.7 as released 6 May 2026. This run did not open the commit to confirm which release contains it. The advisory's suggested remediation is to remove shell=True and add an allow-list, or to require an explicit operator opt-in for BashTool", "source_ids": ["NVD-114107", "GHSA-JQMF", "PYPI"]}After: {"value": "The CVE records and the repository advisories list 0.1.7 as the first unaffected version. The advisories list commit 9454d4a and the v0.1.7 release page among their references but do not mention the commit, version 0.1.7 or a patch in their text; the commit was not opened, so what the fix changes is not shown in the sources read. The project's release list and PyPI date 0.1.7 to 6 May 2026, about five months before the repository advisories were published (2 October 2026) and the CVE records (21 October 2026); the advisories' runtime probes were run on version 0.1.6 plus one frontend fix. The advisory's suggested remediation is to remove shell=True and add an allow-list, or to require an explicit operator opt-in for BashTool", "source_ids": ["NVD-114107", "GHSA-JQMF", "GHSA-V2F8", "PYPI", "GH-REL"]} - 2026-10-21: Fields: evidence event. Found in the editor's source check of 21 october 2026: the github-reviewed advisory ghsa-jqmf-mx4f-hfr6 (osv.dev copy) is headed '10.0 (critical)' for cvss:3.1/av:n/ac:l/pr:n/ui:n/s:c/c:h/i:h/a:h, the same vector its f6 and f7 findings score at 9.0; the field gave only 9.0. the cve records (cveawg.mitre.org copies; nvd for cve-2026-114107) name vulncheck as assigner and give datepublished 21 october 2026; nvd status 'received' was read for cve-2026-114107 only, so the status is now stated for that record.
Show the change
Before: CVE-2026-114107 (shell execution), CVE-2026-114106 (file read) and CVE-2026-114108 (missing authentication) published 21 October 2026 by the VulnCheck CNA (NVD status Received). Severity differs between records: the CNA score in NVD for CVE-2026-114107 is CVSS 3.1 8.8 (user interaction required) and CVSS 4.0 8.7; the repository advisory GHSA-jqmf-mx4f-hfr6, published 2 October 2026, states CVSS 3.1 9.0 (no user interaction) and CVSS 4.0 9.3 for the BashTool and BackgroundRunTool findings. CVE-2026-114106 is CVSS 3.1 7.5 and CVSS 4.0 8.7; CVE-2026-114108 is CVSS 3.1 9.8 and CVSS 4.0 9.3After: CVE-2026-114107 (shell execution), CVE-2026-114106 (file read) and CVE-2026-114108 (missing authentication) were assigned and published on 21 October 2026 (UTC) by VulnCheck, acting as CVE Numbering Authority; NVD lists CVE-2026-114107 with status Received, meaning NVD has not analysed or scored it. Severity scores (CVSS) differ by who assigned them: VulnCheck scores CVE-2026-114107 at CVSS 3.1 8.8 (user interaction required) and CVSS 4.0 8.7, the scores shown in NVD; the repository advisory GHSA-jqmf-mx4f-hfr6, published 2 October 2026 and reviewed by GitHub, is headed CVSS 3.1 10.0, and its BashTool and BackgroundRunTool findings state CVSS 3.1 9.0 (no user interaction) and CVSS 4.0 9.3, although GitHub's headline score for the vector they give is 10.0. VulnCheck scores CVE-2026-114106 at CVSS 3.1 7.5 and CVSS 4.0 8.7, and CVE-2026-114108 at CVSS 3.1 9.8 and CVSS 4.0 9.3 - 2026-10-21: Fields: outcome. Found in the editor's source check of 21 october 2026: ghsa-v2f8-6655-7grj's reproducer is the repository at 'v0.1.6 + 1 frontend fix' run with docker compose from .env.example, and it verifies root with 'docker exec id'; ghsa-5rmq-chc7-m22f's probe 'inside the container' returned /etc/shadow and /proc/self/environ; ghsa-jqmf-mx4f-hfr6 confirms compound commands execute as root but gives the injection route as 'steps to observe'. 'the shipped container' overstated what was probed; ghsa-5rmq and ghsa-v2f8 added as sources.
Show the change
Before: {"value": "State: averted by disclosure. The repository advisories describe runtime probes in the shipped container; exploitation of any deployment is not evidenced in source. As of Oct 2026.", "source_ids": ["GHSA-JQMF", "NVD-114107"]}After: {"value": "State: averted by disclosure. The repository advisories report runtime probes in a Docker deployment built from the repository at version 0.1.6 plus one frontend fix, using the example configuration: they confirm that commands run as root and that read_document returned /etc/shadow and the process environment, but give the routes from a planted instruction or an unauthenticated message to a shell command as steps without a reported result. Exploitation of any deployment is not evidenced in source. As of Oct 2026.", "source_ids": ["GHSA-JQMF", "GHSA-5RMQ", "GHSA-V2F8", "NVD-114107"]} - 2026-10-21: Fields: decision. Found in the editor's source check of 21 october 2026: ghsa-jqmf-mx4f-hfr6 (osv.dev copy) lists 'observe the agent emit a bash tool call for the injected command' under 'steps to observe', an instruction rather than a reported observation, so the model emitting the call is the advisory's assertion, not a fact a primary record reports; type downgraded from fact to assertion and confidence from high to medium. the second clause quotes the advisory unchanged.
Show the change
Before: {"value": "The model emits a tool call carrying the planted command; the repository advisory states the LLM's own judgement is the only barrier and that it collapses under prompt injection", "assertion_type": "fact", "confidence": "high"}After: {"value": "Per the repository advisory, an instruction embedded in an uploaded document is expected to lead the model to emit a tool call carrying the planted command; the advisory gives this as a reproduction step and does not report its result. It states that the LLM's (large language model's) own judgement is the only barrier and that this barrier collapses under prompt injection", "assertion_type": "assertion", "confidence": "medium"} - 2026-10-21: Outcome: severity. Found in the editor's source check of 21 october 2026: the nvd record for cve-2026-114107 gives the 8.8 score with source disclosure@vulncheck.com and status 'received' (no nvd score); the github-reviewed advisory ghsa-jqmf-mx4f-hfr6 (osv.dev copy) is headed '10.0 (critical)' for cvss:3.1/av:n/ac:l/pr:n/ui:n/s:c/c:h/i:h/a:h, and only its f6 and f7 findings state 9.0 for that vector.
Show the change
Before: none reported (CVSS 3.1 8.8 in the NVD record; 9.0 in the repository advisory)After: none reported (severity scores, CVSS (Common Vulnerability Scoring System), differ by who assigned them: VulnCheck, the CVE Numbering Authority, scores CVE-2026-114107 at CVSS 3.1 8.8, shown unchanged in the NVD (National Vulnerability Database) record, which NVD has not yet analysed; the GitHub-reviewed repository advisory is headed CVSS 3.1 10.0, while its BashTool and BackgroundRunTool findings state 9.0 for the same vector) - 2026-10-21: Context: mandate context text. Found in the editor's source check of 21 october 2026: ghsa-v2f8-6655-7grj's reproducer environment is the repository at commit 7452610 ('v0.1.6 + 1 frontend fix; same vuln state as v0.1.6') started with docker compose from the example configuration, not a shipped container image; its finding 1 chain and ghsa-jqmf-mx4f-hfr6's injection step are written as steps to observe, with no recorded result.
Show the change
Before: Vulnerability disclosure; the repository advisories describe runtime probes in the shipped Docker container; no exploitation reported in the sourcesAfter: Vulnerability disclosure; the repository advisories report runtime probes in a Docker deployment built from the repository at version 0.1.6 plus one frontend fix, and give the prompt-injection and unauthenticated routes to the shell as reproduction steps without a reported result; no exploitation reported in the sources - 2026-10-21: Title. Found in the editor's source check of 21 october 2026: the cve record for cve-2026-114107 (vulncheck, shown in nvd) states a capability ('allows remote attackers to execute shell commands as root by planting instructions'), and the repository advisory ghsa-jqmf-mx4f-hfr6 gives the uploaded-document injection only under 'steps to observe' ('observe the agent emit a bash tool call for the injected command') without a reported result, so 'make it run' became 'can make it run'. the project's release list dates v0.1.7 to 6 may 2026, about five months before the advisories (2 october 2026) and the cve records (21 october 2026); the title now says so.
Show the change
Before: Vibe-Trading: instructions planted in documents or web pages the agent processes make it run shell commands as root, because its BashTool and BackgroundRunTool pass model-emitted commands to the shell with no allow-list or approval step; patched in 0.1.7, CVEs published 21 October 2026After: Vibe-Trading: instructions planted in documents or web pages the agent processes can make it run shell commands as root, because its BashTool and BackgroundRunTool pass model-emitted commands to the shell with no allow-list or approval step; patched in 0.1.7 (released 6 May 2026), advisories published 2 October 2026 and CVE (Common Vulnerabilities and Exposures) records 21 October 2026
Record history · 2 entries
- 2026-10-22: Right of reply offered to HKUDS.
- 2026-10-21: Source added: HKUDS/Vibe-Trading GitHub release v0.1.7, 6 May 2026 (release date read in the releasealert.dev listing of the project's GitHub releases; the github.com page could not be opened).
Controls that address what went wrong
4 controls missing or failed. The line under each is the concrete form it would have taken in this case.
Machine-enforceable scope
Mechanism: BashTool and BackgroundRunTool accept any command, with no allow-list. Why it interrupts: an enforced allow-list of permitted commands would refuse commands outside the task, such as reading credential files. Source shows it absent: the NVD record states there is no allow-list. The source does not show which commands an allow-list would have permitted, so the counterfactual is not shown.
Retrieved content as data
Failed: Mechanism: the record names instructions planted in documents or web pages the agent processes as the route to shell execution. Why it interrupts: if processed content were treated only as data, the planted instruction would not become a BashTool or BackgroundRunTool call. Source shows it failed: the CVE record states that planted instructions allow command execution as root, and the advisory states the model's judgement collapses under prompt injection. the advisory gives the uploaded-document case as a reproduction step and does not report its result.
Destructive-action gate
Mechanism: model-emitted commands go to subprocess.run with no approval step, so the planted command runs. Why it interrupts: a confirmation before shell execution would put a human decision between the planted instruction and the command. Source shows it absent: the NVD record states there is no approval step.
Containment and isolation
Mechanism: read_document returns any file the process can read, and commands run as root with no chroot or seccomp, so /etc/shadow, /proc/self/environ and /root credentials are reachable. Why it interrupts: a sandbox limiting the agent's file and process reach would keep those files outside what its tools can return. Source shows it absent: the NVD record states read_document lacks sandbox checks and the advisory states BashTool has no chroot and no seccomp.
New cases like this, once a week. A short email when a case, signal or rule touches software agents. Free; unsubscribe in one click.
Get the weekly emailHow it unfolded, layer by layer
MandateWhat it was told to do
Who deployed it: not evidenced in source. The task: Per the repository advisory, BashTool is intended for legitimately needed shell operations such as installing packages or running provided scripts, BackgroundRunTool for long-running trading-analysis tasks, and read_url for fetching public web pages for market research.
ActorWhat acted
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 (PyPI package vibe-trading-ai), an LLM agent whose auto-discovered tool registry includes BashTool, BackgroundRunTool, read_document and read_url
InputsWhat it could see
Instructions planted by a remote attacker in documents or web pages the agent processes (indirect prompt injection); the repository advisory also describes direct prompts from any anonymous client when API_AUTH_KEY is left unset, as the shipped example configuration leaves it
DecisionHow it chose
Per the repository advisory, an instruction embedded in an uploaded document is expected to lead the model to emit a tool call carrying the planted command; the advisory gives this as a reproduction step and does not report its result. It states that the LLM's (large language model's) own judgement is the only barrier and that this barrier collapses under prompt injection
EnvelopeWhat it was allowed to do
Limits in place: BashTool and BackgroundRunTool pass model-emitted commands to subprocess.run with shell=True and no allow-list or approval step; read_document lacks sandbox checks; the tools are registered by default with no operator opt-in; the shipped container has no USER directive, so the process runs as root.
ActionWhat it did
The agent executes shell commands as root; through its file-read tools it can return /etc/shadow, API keys in /proc/self/environ and /root credentials; read_url fetches arbitrary URLs (server-side request forgery)
OutcomeWhat happened
Caught first by researchers. Severity: none reported (severity scores, CVSS (Common Vulnerability Scoring System), differ by who assigned them: VulnCheck, the CVE Numbering Authority, scores CVE-2026-114107 at CVSS 3.1 8.8, shown unchanged in the NVD (National Vulnerability Database) record, which NVD has not yet analysed; the GitHub-reviewed repository advisory is headed CVSS 3.1 10.0, while its BashTool and BackgroundRunTool findings state 9.0 for the same vector).
EvidenceWhat can be proven
Record of the event: CVE-2026-114107 (shell execution), CVE-2026-114106 (file read) and CVE-2026-114108 (missing authentication) were assigned and published on 21 October 2026 (UTC) by VulnCheck, acting as CVE Numbering Authority; NVD lists CVE-2026-114107 with status Received, meaning NVD has not analysed or scored it. Severity scores (CVSS) differ by who assigned them: VulnCheck scores CVE-2026-114107 at CVSS 3.1 8.8 (user interaction required) and CVSS 4.0 8.7, the scores shown in NVD; the repository advisory GHSA-jqmf-mx4f-hfr6, published by the maintainers on 29 July 2026 and entered in the GitHub Advisory Database on 2 October 2026, is headed CVSS 3.1 10.0, and its BashTool and BackgroundRunTool findings state CVSS 3.1 9.0 (no user interaction) and CVSS 4.0 9.3, although GitHub's headline score for the vector they give is 10.0. VulnCheck scores CVE-2026-114106 at CVSS 3.1 7.5 and CVSS 4.0 8.7, and CVE-2026-114108 at CVSS 3.1 9.8 and CVSS 4.0 9.3.
RecoveryWhat could be stopped, undone, answered for
Technical recovery: The CVE records and the repository advisories list 0.1.7 as the first unaffected version. The advisories list commit 9454d4a and the v0.1.7 release page among their references but do not mention the commit, version 0.1.7 or a patch in their text; the commit was not opened, so what the fix changes is not shown in the sources read. The project's release list and PyPI date 0.1.7 to 6 May 2026, about twelve weeks before the maintainer's advisory for the shell flaw was published (29 July 2026; the GitHub Advisory Database entries are dated 2 October 2026) and about five and a half months before the CVE records (21 October 2026); the advisories' runtime probes were run on version 0.1.6 plus one frontend fix. The advisory's suggested remediation is to remove shell=True and add an allow-list, or to require an explicit operator opt-in for BashTool. Accountability: not evidenced in source.
The same gap in other cases
Cases where the same control was missing or failed. Those in another world are the cross-domain comparisons the Register exists to make.
Cost and accountability
Severitynone reported (severity scores, CVSS (Common Vulnerability Scoring System), differ by who assigned them: VulnCheck, the CVE Numbering Authority, scores CVE-2026-114107 at CVSS 3.1 8.8, shown unchanged in the NVD (National Vulnerability Database) record, which NVD has not yet analysed; the GitHub-reviewed repository advisory is headed CVSS 3.1 10.0, while its BashTool and BackgroundRunTool findings state 9.0 for the same vector)
AffectedNot recorded
Costnone reported
Regulatory or legal consequencenone
Technical recoveryTechnical recovery: The CVE records and the repository advisories list 0.1.7 as the first unaffected version. The advisories list commit 9454d4a and the v0.1.7 release page among their references but do not mention the commit, version 0.1.7 or a patch in their text; the commit was not opened, so what the fix changes is not shown in the sources read. The project's release list and PyPI date 0.1.7 to 6 May 2026, about twelve weeks before the maintainer's advisory for the shell flaw was published (29 July 2026; the GitHub Advisory Database entries are dated 2 October 2026) and about five and a half months before the CVE records (21 October 2026); the advisories' runtime probes were run on version 0.1.6 plus one frontend fix. The advisory's suggested remediation is to remove shell=True and add an allow-list, or to require an explicit operator opt-in for BashTool.
Accountabilitynot evidenced in source
InterpretationWhy it matters beyond its domain. The records show nothing between text the agent read and a root shell except the model's own judgement; they state the route from a planted instruction to a shell command as a capability, with reproduction steps but no reported result, and do not show that any running deployment was exploited. Signed by Saurabh Bhatnagar on 2026-10-22.
Right of reply
| Named party | Status | |
|---|---|---|
| HKUDS | Offered 2026-10-22; awaiting response | Respond for HKUDS |