CVE-2026-114106 in Vibe-Trading
Summary
by MITRE • 10/22/2026
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability that allows remote attackers to read sensitive server files through LLM agent file-read tools. Attackers can prompt the agent to invoke read_document, which lacks sandbox checks, or safe_user_path-gated tools to leak /etc/shadow, /proc/self/environ API keys, and /root credentials.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified in HKUDS Vibe-Trading versions prior to 0.1.7 represents a critical security flaw rooted in improper input validation within the large language model agent framework. This path traversal issue arises from the application's failure to adequately sanitize or restrict file system access when processing user prompts directed at specific tool functions. Specifically, the vulnerability affects tools designed for reading documents and files, where the underlying implementation does not enforce strict boundary checks on file paths provided by the end-user. In a typical secure architecture, any request to read a local resource must be validated against an allowlist of permitted directories or strictly confined within a sandboxed environment that prevents access outside designated boundaries. However, in this instance, the agent's execution logic allows arbitrary path construction, enabling attackers to manipulate file paths using standard traversal sequences such as double dots and forward slashes to escape the intended directory context.
The operational impact of this vulnerability is severe due to the high privileges often associated with LLM agents that interact directly with server resources. By crafting specific prompts, a remote attacker can instruct the agent to invoke functions like read_document or other safe_user_path-gated tools without triggering necessary sandbox checks. This lack of isolation means that the application processes these requests as if they originated from an authorized context within the allowed scope, effectively bypassing security controls designed to limit data exposure. Consequently, attackers gain the ability to read arbitrary files on the host system where the Vibe-Trading service is deployed. The sensitivity of accessible resources includes critical configuration and credential stores such as /etc/shadow which contains hashed user passwords, environment variable files located at /proc/self/environ that may expose API keys and other secrets, and root-level credentials stored in home directories like /root.
From a classification perspective, this vulnerability aligns with CWE-22 Improper Limitation of a Pathname to a Restricted Directory, which describes scenarios where software does not properly neutralize special elements within file names or paths that could cause the application to access files outside of the intended directory. Furthermore, in terms of tactical execution, this flaw facilitates data exfiltration and credential harvesting as described by MITRE ATT&CK techniques related to Command and Control via Application Layer Protocol or Local File Access depending on how the agent is integrated into broader workflows. The exploitation chain relies heavily on social engineering aspects inherent to LLM interactions, where the attacker must craft prompts that successfully trick the model into executing file read operations with maliciously constructed paths rather than legitimate user requests.
Mitigation strategies for this vulnerability require immediate patching of HKUDS Vibe-Trading to version 0.1.7 or later which addresses these path traversal issues through improved input validation and stricter sandbox enforcement. In addition to updating the software, organizations should implement defense-in-depth measures such as running LLM agents within isolated containers with minimal file system permissions. It is also advisable to restrict network access for services handling sensitive data and to monitor agent logs for unusual patterns of tool invocation that involve file path manipulation. Security teams should review all custom tools integrated into their AI workflows to ensure they implement canonicalization checks on input paths before processing, thereby preventing directory traversal attacks regardless of the prompt engineering techniques used by potential adversaries.