Live › vulnerability › CVE-2026-114106
Go to dashboardVibe-Trading versions 0.1.0 through 0.1.6 let remote attackers read sensitive server files through the LLM agent's file-read tools. An attacker can prompt the agent to call read_document, which lacks sandbox checks, to read /etc/shadow, /proc/self/environ API keys, and /root credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check the installed Vibe-Trading version and confirm whether it is below 0.1.7. unknown for any other check.
0.1.7 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability that allows remote attackers to read sensitive server files through LLM agent file-read tools. Attackers can prompt the agent to invoke read_document, which lacks sandbox checks, or safe_user_path-gated tools to leak /etc/shadow, /proc/self/environ API keys, and /root credentials.
This page as .md · .json · in your agent: get_signal("CVE-2026-114106")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.