Live › vulnerability › CVE-2026-114107
Go to dashboardVibe-Trading (PyPI vibe-trading-ai) 0.1.0 to before 0.1.7 registered BashTool and BackgroundRunTool unconditionally. Both pass model-emitted commands to subprocess.run(shell=True) with no allow-list or approval step, so instructions planted in a document or web page the agent reads can run shell commands. The stock container ran as root, and read_url allowed SSRF. With no API_AUTH_KEY set, the session API was also reachable without authentication (CVE-2026-114108). 0.1.7 does not make shell execution safe. It disables the shell tools by default on API, web, Docker and MCP entry points, and an operator can switch them back on.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| vibe-trading-ai | pypi | >= 0.1.0, < 0.1.7 | 0.1.7 |
pip show vibe-trading-ai, or vibe-trading --version (only reports a version in 0.1.7 and later), and treat anything below 0.1.7 as affected0.1.7 or later, check whether VIBE_TRADING_ENABLE_SHELL_TOOLS (or the equivalent shell-tool opt-in) is enabled in agent/.env or the environmentpip install -U vibe-trading-ai (0.1.7 or later), or run docker compose pull && docker compose up -dEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as root by planting instructions in documents or web pages the agent processes. BashTool and BackgroundRunTool pass model-emitted commands to subprocess.run with shell=True and no allow-list or approval step, and read_url fetches arbitrary URLs, enabling command execution and server-side request forgery.
This page as .md · .json · in your agent: get_signal("CVE-2026-114107")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.