{"id":"CVE-2026-114107","kind":"vulnerability","aliases":["CVE-2026-114107"],"related":[],"title":"Vibe-Trading agent: planted web or document text runs root shell commands","description":"HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as root by planting instructions in documents or web pages the agent processes. BashTool and BackgroundRunTool pass model-emitted commands to subprocess.run with shell=True and no allow-list or approval step, and read_url fetches arbitrary URLs, enabling command execution and server-side request forgery.","summary":"Vibe-Trading (PyPI vibe-trading-ai) 0.1.0 to before 0.1.7 registered BashTool and BackgroundRunTool unconditionally. Both pass model-emitted commands to subprocess.run(shell=True) with no allow-list or approval step, so instructions planted in a document or web page the agent reads can run shell commands. The stock container ran as root, and read_url allowed SSRF. With no API_AUTH_KEY set, the session API was also reachable without authentication (CVE-2026-114108). 0.1.7 does not make shell execution safe. It disables the shell tools by default on API, web, Docker and MCP entry points, and an operator can switch them back on.","severity":"high","cvss":8.8,"epss":0.0046,"exploited":false,"exploited_at":null,"products":[{"name":"vibe-trading-ai","fixed":["0.1.7"],"affected":">= 0.1.0, < 0.1.7","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["ai-agents","ai-tooling","docker","mcp","prompt-injection","rce","self-hosted","vibe-trading"],"not_affected_if":["cli-only-no-untrusted-content","version-0.1.7-or-later","version-0.1.7-or-later-with-shell-tools-off"],"how_to_check":"Run pip show vibe-trading-ai, or vibe-trading --version (only reports a version in 0.1.7 and later), and treat anything below 0.1.7 as affected. For Docker, check the image label or run docker compose images, and check whether the container runs as uid 0. On 0.1.7 or later, check whether VIBE_TRADING_ENABLE_SHELL_TOOLS (or the equivalent shell-tool opt-in) is enabled in agent/.env or the environment. If it is on, the same prompt-injection risk remains. Also check whether port 8899 is reachable from other hosts and whether API_AUTH_KEY is set.","fix":"Upgrade with pip install -U vibe-trading-ai (0.1.7 or later), or run docker compose pull && docker compose up -d. Keep the shell-tool opt-in off on any server, API or MCP deployment. Set API_AUTH_KEY and trusted CORS origins, run as a non-root user, and keep the agent away from untrusted documents and web pages if you turn shell tools on.","status":"open","published_at":"2026-10-21T01:17:36+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-23T22:33:26+00:00","updated_at":"2026-10-24T13:15:54+00:00","category":"ai-tooling","confidence":0.85,"triage":{"at":"2026-10-23T22:33:26Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Vibe-Trading to 0.1.7 or later, per the affected range 0.1.0 before 0.1.7.","reach":"internet","title":"Vibe-Trading agent: planted web or document text runs root shell commands","impact":"high","summary":"Vibe-Trading is an AI trading agent whose BashTool and BackgroundRunTool execute model-emitted commands with shell=True and no approval step. An attacker who plants instructions in a document or web page the agent reads can run shell commands as root and make server-side requests through read_url.","category":"ai-tooling","who_cares":["vibe-trading","self-hosted","ai-agents"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker runs shell commands as root on the agent host","analyst_note":"Confirm the exact fixed commit and whether 0.1.7 removes shell=True or only adds approval; check the NVD entry for the advisory URL.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["version-0.1.7-or-later"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000504,"input_tokens":3006,"output_tokens":406,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the exact fixed commit and whether 0.1.7 removes shell=True or only adds approval; check the NVD entry for the advisory URL.","search":"'-114107':16A,19A '-114108':120B '-2026':15A,18A,119B '0.1.0':50B,155C '0.1.7':53B,121B,157C 'agent':4A,26B,87B,183C 'ai':23A,25B,28B,49B 'ai-ag':24B 'ai-tool':27B 'allow':72B,102B,165C,201C 'allow-list':71B,200C 'also':114B 'api':106B,112B,136B 'approv':75B,204C 'arbitrari':210C 'attack':167C 'auth':107B 'authent':117B 'back':149B 'backgroundruntool':57B,187C 'bashtool':55B,185C 'command':13A,64B,92B,171C,192C,213C 'contain':95B,158C 'cve':14A,17A,118B 'default':134B 'disabl':129B 'docker':30B,138B 'document':8A,82B,178C 'emit':63B,191C 'enabl':212C 'entri':141B 'execut':126B,169C,214C 'fetch':209C 'forgeri':220C 'hkud':150C 'host':38B 'indirect':160C 'inject':34B,162C 'instruct':78B,176C 'key':108B 'list':73B,202C 'make':124B 'mcp':31B,140B 'model':62B,190C 'model-emit':61B,189C 'oper':145B 'page':85B,181C 'pass':60B,188C 'plant':5A,79B,175C 'point':142B 'process':184C 'prompt':33B,161C 'prompt-inject':32B 'pypi':45B 'ran':96B 'rce':35B 'reachabl':115B 'read':88B,100B,207C 'regist':54B 'remot':166C 'request':219C 'root':11A,98B,173C 'run':10A,90B 'safe':127B 'self':37B 'self-host':36B 'server':217C 'server-sid':216C 'session':111B 'set':109B 'shell':12A,67B,91B,125B,131B,170C,196C 'side':218C 'ssrf':103B 'step':76B,205C 'stock':94B 'subprocess.run':66B,194C 'switch':147B 'text':9A 'tool':29B,132B 'trade':3A,41B,44B,48B,153C 'trading':22A 'true':68B,197C 'uncondit':58B 'url':101B,208C,211C 'vibe':2A,21A,40B,43B,47B,152C 'vibe-trad':1A,39B,42B,151C 'vibe-trading-ai':20A,46B 'vulner':163C 'web':6A,84B,137B,180C 'without':116B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T01:17:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114107","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114107","severity":null,"published_at":"2026-10-21T01:17:36+00:00","modified_at":"2026-10-22T17:40:46+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114107:251","url":null,"severity":null,"published_at":"2026-10-23T22:34:16+00:00","modified_at":"2026-10-23T22:34:16+00:00","first_seen_at":"2026-10-23T22:34:16+00:00","fetched_at":"2026-10-23T22:34:16+00:00","note":"Read GHSA-jqmf-mx4f-hfr6, v0.1.7 release notes and v0.1.7 source. Fix is commit 9454d4a (release also has e07cdc9). 0.1.7 does NOT remove shell=True: bash_tool.py still calls subprocess.run(shell=True) with no approval step. It gates bash and background_run out of the tool registry unless include_shell_tools / VIBE_TRADING_ENABLE_SHELL_TOOLS is set (CLI entry points enable it, network entry points default off). The container now runs as non-root. No exploitation reports found; the advisory has a step-by-step reproducer but I found no separate PoC repo. I did not search social posts. CVSS: NVD v3.1 8.8, v4 8.7; GHSA lists the per-finding scores higher. CVE-2026-114106 and CVE-2026-114108 are siblings from the same advisory set."},{"source":"epss","external_id":"CVE-2026-114107","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114107","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[{"id":1510,"url":"https://github.com/HKUDS/Vibe-Trading/security/advisories/GHSA-jqmf-mx4f-hfr6","title":"GHSA-jqmf-mx4f-hfr6 Vibe-Trading LLM-callable tool primitives","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1511,"url":"https://github.com/HKUDS/Vibe-Trading/releases/tag/v0.1.7","title":"Vibe-Trading v0.1.7 release notes","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1512,"url":"https://github.com/HKUDS/Vibe-Trading/commit/9454d4a27a763b80e1d6eb5763b86c88e9e4e714","title":"Commit 9454d4a Harden API and tool security defaults","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1513,"url":"https://osv.dev/vulnerability/CVE-2026-114107","title":"OSV CVE-2026-114107","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}