Vibe-Trading: instructions planted in documents or web pages the agent processes can make it run shell commands as root, because its BashTool and BackgroundRunTool pass model-emitted commands to the shell with no allow-list or approval step; patched in 0.1.7 (released 6 May 2026), the maintainer's advisory for the shell flaw published 29 July 2026 and CVE (Common Vulnerabilities and Exposures) records 21 October 2026
The typed evidence object. This is the working store; the case page is the reader's form.
| Layer / facet | Value | Type | Sources | Conf. |
|---|---|---|---|---|
| Mandate: principal | not evidenced in source | assertion | NVD record CVE-2026-114107: HKUDS Vibe-Trading from 0.1.0 before 0.1.7, indirect prompt injection makes BashTool and BackgroundRunTool run shell commands as root with no allow-list or approval step; read_url SSRF; CVSS 3.1 8.8 | low |
| Mandate: objective | Per the repository advisory, BashTool is intended for legitimately needed shell operations such as installing packages or running provided scripts, BackgroundRunTool for long-running trading-analysis tasks, and read_url for fetching public web pages for market research | assertion | HKUDS/Vibe-Trading repository security advisory GHSA-jqmf-mx4f-hfr6: LLM-callable tools permit command execution, code injection, and SSRF; affects 0.1.0 to before 0.1.7, fixed in 0.1.7 (published by the maintainers 29 July 2026; entered in the GitHub Advisory Database 2 October 2026; read on github.com and as mirrored by OSV) | medium |
| Actor | HKUDS Vibe-Trading from 0.1.0 before 0.1.7 (PyPI package vibe-trading-ai), an LLM agent whose auto-discovered tool registry includes BashTool, BackgroundRunTool, read_document and read_url | fact | NVD record CVE-2026-114107: HKUDS Vibe-Trading from 0.1.0 before 0.1.7, indirect prompt injection makes BashTool and BackgroundRunTool run shell commands as root with no allow-list or approval step; read_url SSRF; CVSS 3.1 8.8; NVD record CVE-2026-114106: HKUDS Vibe-Trading from 0.1.0 before 0.1.7, path traversal through the agent's file-read tools (read_document lacks sandbox checks) leaks /etc/shadow, /proc/self/environ API keys and /root credentials; CVSS 3.1 7.5; HKUDS/Vibe-Trading repository security advisory GHSA-jqmf-mx4f-hfr6: LLM-callable tools permit command execution, code injection, and SSRF; affects 0.1.0 to before 0.1.7, fixed in 0.1.7 (published by the maintainers 29 July 2026; entered in the GitHub Advisory Database 2 October 2026; read on github.com and as mirrored by OSV); HKUDS/Vibe-Trading repository security advisory GHSA-5rmq-chc7-m22f: file-read tools expose arbitrary server-readable files; container runs as root (read as mirrored at api.osv.dev/v1/vulns/GHSA-5rmq-chc7-m22f) (date shown is the GitHub Advisory Database entry; the repository page's own publication date was not read) | high |
| Inputs | Instructions planted by a remote attacker in documents or web pages the agent processes (indirect prompt injection); the repository advisory also describes direct prompts from any anonymous client when API_AUTH_KEY is left unset, as the shipped example configuration leaves it | fact | NVD record CVE-2026-114107: HKUDS Vibe-Trading from 0.1.0 before 0.1.7, indirect prompt injection makes BashTool and BackgroundRunTool run shell commands as root with no allow-list or approval step; read_url SSRF; CVSS 3.1 8.8; NVD record CVE-2026-114108: HKUDS Vibe-Trading from 0.1.0 before 0.1.7, missing authentication when API_AUTH_KEY is unset lets unauthenticated attackers post messages that trigger root shell commands via BashTool; CVSS 3.1 9.8; HKUDS/Vibe-Trading repository security advisory GHSA-jqmf-mx4f-hfr6: LLM-callable tools permit command execution, code injection, and SSRF; affects 0.1.0 to before 0.1.7, fixed in 0.1.7 (published by the maintainers 29 July 2026; entered in the GitHub Advisory Database 2 October 2026; read on github.com and as mirrored by OSV); HKUDS/Vibe-Trading repository security advisory GHSA-v2f8-6655-7grj: FastAPI endpoints permit unauthenticated access when API_AUTH_KEY is unset, file upload, and an RCE chain (read as mirrored at api.osv.dev/v1/vulns/GHSA-v2f8-6655-7grj) (date shown is the GitHub Advisory Database entry; the repository page's own publication date was not read) | high |
| Decision | Per the repository advisory, an instruction embedded in an uploaded document is expected to lead the model to emit a tool call carrying the planted command; the advisory gives this as a reproduction step and does not report its result. It states that the LLM's (large language model's) own judgement is the only barrier and that this barrier collapses under prompt injection | assertion | NVD record CVE-2026-114107: HKUDS Vibe-Trading from 0.1.0 before 0.1.7, indirect prompt injection makes BashTool and BackgroundRunTool run shell commands as root with no allow-list or approval step; read_url SSRF; CVSS 3.1 8.8; HKUDS/Vibe-Trading repository security advisory GHSA-jqmf-mx4f-hfr6: LLM-callable tools permit command execution, code injection, and SSRF; affects 0.1.0 to before 0.1.7, fixed in 0.1.7 (published by the maintainers 29 July 2026; entered in the GitHub Advisory Database 2 October 2026; read on github.com and as mirrored by OSV) | medium |
| Envelope: constraints | BashTool and BackgroundRunTool pass model-emitted commands to subprocess.run with shell=True and no allow-list or approval step; read_document lacks sandbox checks; the tools are registered by default with no operator opt-in; the shipped container has no USER directive, so the process runs as root | fact | NVD record CVE-2026-114107: HKUDS Vibe-Trading from 0.1.0 before 0.1.7, indirect prompt injection makes BashTool and BackgroundRunTool run shell commands as root with no allow-list or approval step; read_url SSRF; CVSS 3.1 8.8; NVD record CVE-2026-114106: HKUDS Vibe-Trading from 0.1.0 before 0.1.7, path traversal through the agent's file-read tools (read_document lacks sandbox checks) leaks /etc/shadow, /proc/self/environ API keys and /root credentials; CVSS 3.1 7.5; HKUDS/Vibe-Trading repository security advisory GHSA-jqmf-mx4f-hfr6: LLM-callable tools permit command execution, code injection, and SSRF; affects 0.1.0 to before 0.1.7, fixed in 0.1.7 (published by the maintainers 29 July 2026; entered in the GitHub Advisory Database 2 October 2026; read on github.com and as mirrored by OSV); HKUDS/Vibe-Trading repository security advisory GHSA-5rmq-chc7-m22f: file-read tools expose arbitrary server-readable files; container runs as root (read as mirrored at api.osv.dev/v1/vulns/GHSA-5rmq-chc7-m22f) (date shown is the GitHub Advisory Database entry; the repository page's own publication date was not read) | high |
| Action | The agent executes shell commands as root; through its file-read tools it can return /etc/shadow, API keys in /proc/self/environ and /root credentials; read_url fetches arbitrary URLs (server-side request forgery) | fact | NVD record CVE-2026-114107: HKUDS Vibe-Trading from 0.1.0 before 0.1.7, indirect prompt injection makes BashTool and BackgroundRunTool run shell commands as root with no allow-list or approval step; read_url SSRF; CVSS 3.1 8.8; NVD record CVE-2026-114106: HKUDS Vibe-Trading from 0.1.0 before 0.1.7, path traversal through the agent's file-read tools (read_document lacks sandbox checks) leaks /etc/shadow, /proc/self/environ API keys and /root credentials; CVSS 3.1 7.5 | high |
| Outcome | State: averted by disclosure. The repository advisories report runtime probes in a Docker deployment built from the repository at version 0.1.6 plus one frontend fix, using the example configuration: they confirm that commands run as root and that read_document returned /etc/shadow and the process environment, but give the routes from a planted instruction or an unauthenticated message to a shell command as steps without a reported result. Exploitation of any deployment is not evidenced in source. As of Oct 2026. | assertion | HKUDS/Vibe-Trading repository security advisory GHSA-jqmf-mx4f-hfr6: LLM-callable tools permit command execution, code injection, and SSRF; affects 0.1.0 to before 0.1.7, fixed in 0.1.7 (published by the maintainers 29 July 2026; entered in the GitHub Advisory Database 2 October 2026; read on github.com and as mirrored by OSV); HKUDS/Vibe-Trading repository security advisory GHSA-5rmq-chc7-m22f: file-read tools expose arbitrary server-readable files; container runs as root (read as mirrored at api.osv.dev/v1/vulns/GHSA-5rmq-chc7-m22f) (date shown is the GitHub Advisory Database entry; the repository page's own publication date was not read); HKUDS/Vibe-Trading repository security advisory GHSA-v2f8-6655-7grj: FastAPI endpoints permit unauthenticated access when API_AUTH_KEY is unset, file upload, and an RCE chain (read as mirrored at api.osv.dev/v1/vulns/GHSA-v2f8-6655-7grj) (date shown is the GitHub Advisory Database entry; the repository page's own publication date was not read); NVD record CVE-2026-114107: HKUDS Vibe-Trading from 0.1.0 before 0.1.7, indirect prompt injection makes BashTool and BackgroundRunTool run shell commands as root with no allow-list or approval step; read_url SSRF; CVSS 3.1 8.8 | medium |
| Evidence: event | CVE-2026-114107 (shell execution), CVE-2026-114106 (file read) and CVE-2026-114108 (missing authentication) were assigned and published on 21 October 2026 (UTC) by VulnCheck, acting as CVE Numbering Authority; NVD lists CVE-2026-114107 with status Received, meaning NVD has not analysed or scored it. Severity scores (CVSS) differ by who assigned them: VulnCheck scores CVE-2026-114107 at CVSS 3.1 8.8 (user interaction required) and CVSS 4.0 8.7, the scores shown in NVD; the repository advisory GHSA-jqmf-mx4f-hfr6, published by the maintainers on 29 July 2026 and entered in the GitHub Advisory Database on 2 October 2026, is headed CVSS 3.1 10.0, and its BashTool and BackgroundRunTool findings state CVSS 3.1 9.0 (no user interaction) and CVSS 4.0 9.3, although GitHub's headline score for the vector they give is 10.0. VulnCheck scores CVE-2026-114106 at CVSS 3.1 7.5 and CVSS 4.0 8.7, and CVE-2026-114108 at CVSS 3.1 9.8 and CVSS 4.0 9.3 | fact | NVD record CVE-2026-114107: HKUDS Vibe-Trading from 0.1.0 before 0.1.7, indirect prompt injection makes BashTool and BackgroundRunTool run shell commands as root with no allow-list or approval step; read_url SSRF; CVSS 3.1 8.8; NVD record CVE-2026-114106: HKUDS Vibe-Trading from 0.1.0 before 0.1.7, path traversal through the agent's file-read tools (read_document lacks sandbox checks) leaks /etc/shadow, /proc/self/environ API keys and /root credentials; CVSS 3.1 7.5; NVD record CVE-2026-114108: HKUDS Vibe-Trading from 0.1.0 before 0.1.7, missing authentication when API_AUTH_KEY is unset lets unauthenticated attackers post messages that trigger root shell commands via BashTool; CVSS 3.1 9.8; HKUDS/Vibe-Trading repository security advisory GHSA-jqmf-mx4f-hfr6: LLM-callable tools permit command execution, code injection, and SSRF; affects 0.1.0 to before 0.1.7, fixed in 0.1.7 (published by the maintainers 29 July 2026; entered in the GitHub Advisory Database 2 October 2026; read on github.com and as mirrored by OSV) | high |
| Recovery: technical | The CVE records and the repository advisories list 0.1.7 as the first unaffected version. The advisories list commit 9454d4a and the v0.1.7 release page among their references but do not mention the commit, version 0.1.7 or a patch in their text; the commit was not opened, so what the fix changes is not shown in the sources read. The project's release list and PyPI date 0.1.7 to 6 May 2026, about twelve weeks before the maintainer's advisory for the shell flaw was published (29 July 2026; the GitHub Advisory Database entries are dated 2 October 2026) and about five and a half months before the CVE records (21 October 2026); the advisories' runtime probes were run on version 0.1.6 plus one frontend fix. The advisory's suggested remediation is to remove shell=True and add an allow-list, or to require an explicit operator opt-in for BashTool | assertion | NVD record CVE-2026-114107: HKUDS Vibe-Trading from 0.1.0 before 0.1.7, indirect prompt injection makes BashTool and BackgroundRunTool run shell commands as root with no allow-list or approval step; read_url SSRF; CVSS 3.1 8.8; HKUDS/Vibe-Trading repository security advisory GHSA-jqmf-mx4f-hfr6: LLM-callable tools permit command execution, code injection, and SSRF; affects 0.1.0 to before 0.1.7, fixed in 0.1.7 (published by the maintainers 29 July 2026; entered in the GitHub Advisory Database 2 October 2026; read on github.com and as mirrored by OSV); HKUDS/Vibe-Trading repository security advisory GHSA-v2f8-6655-7grj: FastAPI endpoints permit unauthenticated access when API_AUTH_KEY is unset, file upload, and an RCE chain (read as mirrored at api.osv.dev/v1/vulns/GHSA-v2f8-6655-7grj) (date shown is the GitHub Advisory Database entry; the repository page's own publication date was not read); PyPI project page vibe-trading-ai: release history, 0.1.7 uploaded 6 May 2026; HKUDS/Vibe-Trading GitHub release v0.1.7, 6 May 2026 (release date read in the releasealert.dev listing of the project's GitHub releases; the github.com page could not be opened) | medium |
| Recovery: accountability | not evidenced in source | assertion | NVD record CVE-2026-114107: HKUDS Vibe-Trading from 0.1.0 before 0.1.7, indirect prompt injection makes BashTool and BackgroundRunTool run shell commands as root with no allow-list or approval step; read_url SSRF; CVSS 3.1 8.8 | low |
Controls
| Status | Control | Canonical |
|---|---|---|
| failed | Mechanism: the record names instructions planted in documents or web pages the agent processes as the route to shell execution. Why it interrupts: if processed content were treated only as data, the planted instruction would not become a BashTool or BackgroundRunTool call. Source shows it failed: the CVE record states that planted instructions allow command execution as root, and the advisory states the model's judgement collapses under prompt injection; the advisory gives the uploaded-document case as a reproduction step and does not report its result. | C-I1 Retrieved content as data |
| absent | Mechanism: model-emitted commands go to subprocess.run with no approval step, so the planted command runs. Why it interrupts: a confirmation before shell execution would put a human decision between the planted instruction and the command. Source shows it absent: the NVD record states there is no approval step. | C-E3 Destructive-action gate |
| absent | Mechanism: BashTool and BackgroundRunTool accept any command, with no allow-list. Why it interrupts: an enforced allow-list of permitted commands would refuse commands outside the task, such as reading credential files. Source shows it absent: the NVD record states there is no allow-list. The source does not show which commands an allow-list would have permitted, so the counterfactual is not shown. | C-M2 Machine-enforceable scope |
| absent | Mechanism: read_document returns any file the process can read, and commands run as root with no chroot or seccomp, so /etc/shadow, /proc/self/environ and /root credentials are reachable. Why it interrupts: a sandbox limiting the agent's file and process reach would keep those files outside what its tools can return. Source shows it absent: the NVD record states read_document lacks sandbox checks and the advisory states BashTool has no chroot and no seccomp. | C-E5 Containment and isolation |
Inference
inference The records show nothing between text the agent read and a root shell except the model's own judgement; they state the route from a planted instruction to a shell command as a capability, with reproduction steps but no reported result, and do not show that any running deployment was exploited.
Sources
| ID | Record | Type | Link |
|---|---|---|---|
| NVD-114107 | NVD record CVE-2026-114107: HKUDS Vibe-Trading from 0.1.0 before 0.1.7, indirect prompt injection makes BashTool and BackgroundRunTool run shell commands as root with no allow-list or approval step; read_url SSRF; CVSS 3.1 8.8 | public record primary record | nvd.nist.gov ↗ checked 2026-10-21 |
| NVD-114106 | NVD record CVE-2026-114106: HKUDS Vibe-Trading from 0.1.0 before 0.1.7, path traversal through the agent's file-read tools (read_document lacks sandbox checks) leaks /etc/shadow, /proc/self/environ API keys and /root credentials; CVSS 3.1 7.5 | public record primary record | nvd.nist.gov ↗ checked 2026-10-21 |
| GHSA-JQMF | HKUDS/Vibe-Trading repository security advisory GHSA-jqmf-mx4f-hfr6: LLM-callable tools permit command execution, code injection, and SSRF; affects 0.1.0 to before 0.1.7, fixed in 0.1.7 (published by the maintainers 29 July 2026; entered in the GitHub Advisory Database 2 October 2026; read on github.com and as mirrored by OSV) (interest: Published in the project's own repository) | company primary record | github.com ↗ checked 2026-10-21 |
| GHSA-5RMQ | HKUDS/Vibe-Trading repository security advisory GHSA-5rmq-chc7-m22f: file-read tools expose arbitrary server-readable files; container runs as root (read as mirrored at api.osv.dev/v1/vulns/GHSA-5rmq-chc7-m22f) (date shown is the GitHub Advisory Database entry; the repository page's own publication date was not read) (interest: Published in the project's own repository) | company primary record | github.com ↗ checked 2026-10-21 |
| GHSA-V2F8 | HKUDS/Vibe-Trading repository security advisory GHSA-v2f8-6655-7grj: FastAPI endpoints permit unauthenticated access when API_AUTH_KEY is unset, file upload, and an RCE chain (read as mirrored at api.osv.dev/v1/vulns/GHSA-v2f8-6655-7grj) (date shown is the GitHub Advisory Database entry; the repository page's own publication date was not read) (interest: Published in the project's own repository) | company primary record | github.com ↗ checked 2026-10-21 |
| PYPI | PyPI project page vibe-trading-ai: release history, 0.1.7 uploaded 6 May 2026 (interest: The project's package listing) | company secondary | pypi.org ↗ checked 2026-10-21 |
| NVD-114108 | NVD record CVE-2026-114108: HKUDS Vibe-Trading from 0.1.0 before 0.1.7, missing authentication when API_AUTH_KEY is unset lets unauthenticated attackers post messages that trigger root shell commands via BashTool; CVSS 3.1 9.8 | public record primary record | nvd.nist.gov ↗ checked 2026-10-21 |
| GH-REL | HKUDS/Vibe-Trading GitHub release v0.1.7, 6 May 2026 (release date read in the releasealert.dev listing of the project's GitHub releases; the github.com page could not be opened) (interest: The project's own release) | company primary record | github.com ↗ checked 2026-10-21 |