CVE-2026-58173: fallo de gravedad media en HKUDS Vibe-Trading
Vibe-Trading < 0.1.10 - Path Traversal via Persistent Memory Type
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6epss 0.4%
Vibe-Trading before 0.1.10 contains a path traversal vulnerability that allows attackers to write files outside the intended memory root directory by supplying a malicious memory_type value containing path traversal sequences through the remember tool. Attackers can manipulate the memory_type parameter in the persistent memory store to cause the application to write arbitrary Markdown files to unintended locations on the filesystem.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Productos afectados
HKUDS · Vibe-TradingCVEs relacionadas — HKUDS Vibe-Trading
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-114107HIGHHKUDS Vibe-Trading 0.1.0 before 0.1.7 Indirect Prompt Injection RCE via BashTool and BackgroundRunToolEPSS 0.6%CVE-2026-58170HIGHVibe-Trading < 0.1.10 - Path Traversal in Proposal Identifier Allows Forging Live Trading MandatesEPSS 0.6%CVE-2026-114108CRITICALHKUDS Vibe-Trading before 0.1.7 Missing Authentication in FastAPI Server Enabling RCEEPSS 0.5%CVE-2026-114106HIGHHKUDS Vibe-Trading 0.1.0 before 0.1.7 Path Traversal via read_document and safe_user_pathEPSS 0.4%CVE-2026-58169HIGHVibe-Trading < 0.1.10 - Loopback Trust and Missing Host Validation Enable DNS-Rebinding Authentication Bypass and Remote Code ExecutionEPSS 0.4%CVE-2026-58171LOWVibe-Trading < 0.1.10 - Path Traversal via Swarm Run IdentifierEPSS 0.3%