CVE-2026-114107: HKUDS Vibe-Trading 0.1.0 before 0.1.7 Indirect Prompt Injection RCE via BashTool and BackgroundRunTool
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as root by planting instructions in documents or web pages the agent processes. BashTool and BackgroundRunTool pass model-emitted commands to subprocess.run with shell=True and no allow-list or approval step, and readurl fetches arbitrary URLs, enabling command execution and server-side request forgery.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HKUDS Vibe-Tradingto a version that resolves this vulnerability.Fixed in 0.1.7
Event History
Frequently Asked Questions
Which deployments are exposed?
HKUDS Vibe-Trading versions 0.1.0 through versions before 0.1.7 are affected. Deployments are exposed when the agent processes attacker-influenced documents, web pages, or URLs.
What does an attacker need to exploit this issue?
An attacker does not need prior privileges, but does need the agent to process content containing planted instructions, such as a document or web page. User interaction is required for that content to be processed.
What access could successful exploitation provide?
The vulnerability can cause shell commands to run as root because model-emitted commands are passed to subprocess.run with shell=True without an allow-list or approval step. It can also enable server-side request forgery through arbitrary URL fetching.
What can be done if updating is not immediately possible?
Do not allow the agent to process untrusted documents, web pages, or arbitrary URLs. Restrict or disable BashTool, BackgroundRunTool, and arbitrary URL fetching where possible, and avoid running the service as root.