Skip to content
Fencer Vulns
high 8.8

CVE-2026-114107 json

HKUDS Vibe-Trading 0.1.0 before 0.1.7 Indirect Prompt Injection RCE via BashTool and BackgroundRunTool

published 2026-10-02 37 d ago modified 2026-10-22 17 d ago also GHSA-jqmf-mx4f-hfr6 , EUVD-2026-106910

cvss
8.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 47%
public exploits
0
none known

Summary

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as root by planting instructions in documents or web pages the agent processes. BashTool and BackgroundRunTool pass model-emitted commands to subprocess.run with shell=True and no allow-list or approval step, and read_url fetches arbitrary URLs, enabling command execution and server-side request forgery.

Patch / fix

  • pypi vibe-trading-ai 0.1.7
  • HKUDS Vibe-Trading 0.1.7

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
17 d ago

Exploit prediction

0.58% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
GitHub 3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
pypi vibe-trading-ai
>=0.1.0, <0.1.7
0.1.7

Affected products

  • HKUDS Vibe-Trading

Classification

Weakness
  • CWE-1427 Improper Neutralization of Input Used for LLM Prompting
  • CWE-116 Improper Encoding or Escaping of Output
  • CWE-77 Improper Neutralization of Special Elements used in a Command
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command
  • CWE-918 Server-Side Request Forgery
  • CWE-94 Improper Control of Generation of Code

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.