CVE-2026-58170highCWE-22

CVE-2026-58170: falha de alta gravidade em HKUDS Vibe-Trading

Vibe-Trading < 0.1.10 - Path Traversal in Proposal Identifier Allows Forging Live Trading Mandates

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Vibe-Trading

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.2epss 0.6%
Vibe-Trading before 0.1.10 builds the proposal file path by joining a caller-supplied proposal identifier onto the broker proposals directory without sanitization (agent/src/live/mandate/commit.py). A proposal identifier containing path traversal sequences causes the application to load an attacker-controlled JSON file as an authoritative live trading mandate. Combined with the file upload endpoint, an admitted caller can write a JSON file to a known location and traverse to it, and because the ceilings validation is skipped when ceilings are absent, the attacker fully controls the committed mandate.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
HKUDS · Vibe-Trading
CVEs relacionadas — HKUDS Vibe-Trading

No mesmo produto, das mais perigosas para as menos.

CVE-2026-114107HIGHHKUDS Vibe-Trading 0.1.0 before 0.1.7 Indirect Prompt Injection RCE via BashTool and BackgroundRunToolEPSS 0.6%CVE-2026-114108CRITICALHKUDS Vibe-Trading before 0.1.7 Missing Authentication in FastAPI Server Enabling RCEEPSS 0.5%CVE-2026-58173MEDIUMVibe-Trading < 0.1.10 - Path Traversal via Persistent Memory TypeEPSS 0.4%CVE-2026-114106HIGHHKUDS Vibe-Trading 0.1.0 before 0.1.7 Path Traversal via read_document and safe_user_pathEPSS 0.4%CVE-2026-58169HIGHVibe-Trading < 0.1.10 - Loopback Trust and Missing Host Validation Enable DNS-Rebinding Authentication Bypass and Remote Code ExecutionEPSS 0.4%CVE-2026-58171LOWVibe-Trading < 0.1.10 - Path Traversal via Swarm Run IdentifierEPSS 0.3%