CVE-2026-114107 in Vibe-Trading
Summary
by MITRE • 10/22/2026
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as root by planting instructions in documents or web pages the agent processes. BashTool and BackgroundRunTool pass model-emitted commands to subprocess.run with shell=True and no allow-list or approval step, and read_url fetches arbitrary URLs, enabling command execution and server-side request forgery.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified as an indirect prompt injection in HKUDS Vibe-Trading versions prior to 0.1.7 represents a critical security flaw within the agent's processing pipeline for external content. This issue stems from the system's failure to adequately sanitize or validate instructions embedded within documents and web pages before they are interpreted by the underlying large language model. When an attacker plants malicious prompts in these accessible resources, the AI agent processes them as legitimate operational directives rather than untrusted data. This fundamental misclassification of input allows remote attackers to manipulate the agent into executing arbitrary actions on behalf of the user or system administrator, effectively bypassing intended security boundaries through social engineering and technical exploitation combined.
The core technical flaw lies in how specific tools within the Vibe-Trading framework handle commands generated by the model. The BashTool and BackgroundRunTool are designed to execute shell commands but lack critical safeguards such as allow-lists for permitted operations or mandatory approval steps before execution. Crucially, these tools invoke subprocess.run with the shell parameter set to true without restricting the scope of allowed characters or command structures. This configuration enables a direct path for arbitrary code execution because any model-emitted string is passed directly to the operating system's command interpreter. Consequently, an attacker who can influence the model's output through injected prompts in processed documents can force the agent to run shell commands with root privileges, leading to complete compromise of the host environment.
Furthermore, the vulnerability extends beyond local code execution into network-based attacks via server-side request forgery. The read_url function within the application fetches arbitrary URLs provided by the model's output without sufficient validation or restriction on destination domains. This capability allows an attacker to direct the agent to make HTTP requests to internal services that are not exposed to the public internet, potentially exfiltrating sensitive data from behind firewalls or interacting with vulnerable internal APIs. The combination of unrestricted URL fetching and shell command execution creates a powerful attack vector where initial access through prompt injection can be leveraged for lateral movement within a network infrastructure or extraction of confidential information stored on local systems.
From an industry standard perspective, this vulnerability aligns closely with CWE-94 Improper Control of Generation of Code (Code Injection) due to the untrusted input being executed as code by the shell interpreter. It also maps to CWE-78 Improper Neutralization of Special Elements used in an OS Command (OS Command Injection), specifically regarding the use of shell=True without proper sanitization. In terms of adversarial tactics, this scenario reflects MITRE ATT&CK technique T1059 Command and Scripting Interpreter, where attackers utilize system utilities to execute commands. Additionally, the ability to fetch arbitrary URLs relates to MITRE ATT&CK tactic TA0008 Lateral Movement or potentially data exfiltration depending on the target of the forged requests, highlighting the risk of SSRF in AI-driven applications that interact with external resources.
Mitigation strategies must focus on implementing strict input validation and output sanitization within the agent's processing loop. Developers should avoid passing model-generated content directly to system interpreters without a robust allow-list mechanism that restricts commands to a predefined set of safe operations. The use of shell=True in subprocess calls should be eliminated or strictly controlled, preferring direct execution of binaries with explicit arguments instead of relying on shell parsing which is prone to injection attacks. For the read_url functionality, implementing domain whitelisting and validating URL structures against known malicious patterns can prevent server-side request forgery attempts. Additionally, introducing a human-in-the-loop approval step for high-privilege actions or sensitive operations would provide an essential layer of defense against automated exploitation by injected prompts.