Path Traversal Vulnerability in HKUDS Vibe-Trading Software
CVE-2026-114106

8.7HIGH

Key Information:

Vendor

Hkuds

Status
Vibe-trading
Vendor
CVE Published:
21 October 2026

What is CVE-2026-114106?

The HKUDS Vibe-Trading software versions before 0.1.7 are susceptible to a path traversal vulnerability that enables remote attackers to exploit the LLM agent file-read functionalities. By invoking the read_document function, which lacks essential sandbox protections, attackers can access sensitive files such as /etc/shadow, /proc/self/environ, and root credentials, potentially leading to severe security breaches.

Affected Version(s)

Vibe-Trading 0.1.0 < 0.1.7

Vibe-Trading 0.1.7

References

https://github.com/HKUDS/Vibe-Trading/security/advisories...
vendor-advisory
https://www.vulncheck.com/advisories/hkuds-vibe-trading-0...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

lemi9090
.