CVE-2026-58173
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
A path traversal vulnerability in Vibe-Trading before version 0.1.10 allows attackers to write files outside the intended memory root directory by supplying a malicious memory_type value containing path traversal sequences through the remember tool. Attackers can manipulate the memory_type parameter in the persistent memory store to cause the application to write arbitrary Markdown files to unintended locations on the filesystem.
Risk Assessment
The risk involves the ability to overwrite or create files in sensitive system locations, potentially leading to privilege escalation, execution of malicious code, or data integrity compromise.
Recommendation
Immediately update Vibe-Trading to version 0.1.10 or later, which includes a fix that eliminates the path traversal vulnerability.
Other vulnerabilities in Vibe-Trading
See all- CVE-2026-114108Critical
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because require_auth() returns early when API_AUTH_KEY is unset. Attackers can post messages to /sessions/{id}/messages to trigger root shell commands via BashTool, upload .py or .sh files via /upload, read session histories, and obtain partial API keys.
- CVE-2026-58171Medium
A vulnerability in Vibe-Trading before version 0.1.10 allows reading and overwriting run.json files outside the runs directory. An attacker can supply a crafted run identifier via MCP swarm tools, leading to unauthorized file access.
- CVE-2026-58170High
A path traversal vulnerability in Vibe-Trading before version 0.1.10 allows an attacker to inject path traversal sequences into the proposal identifier when building the proposal file path. This causes the application to load an attacker-controlled JSON file as an authoritative live trading mandate.
- CVE-2026-58169High
A DNS rebinding authentication bypass vulnerability in Vibe-Trading before 0.1.10 allows remote attackers to bypass bearer-token authentication by exploiting the server's trust of TCP peer addresses for loopback clients combined with missing Host header validation while binding to 0.0.0.0 with credentialed CORS. Attackers can craft a malicious DNS rebinding page to issue authenticated requests to the local API server, reach the shell execution endpoint with a bash-enabled preset, and achieve remote code execution as the API process user while also overwriting LLM and data-source settings to exfiltrate credentials.
Original NVD description (English source)
Vibe-Trading before 0.1.10 contains a path traversal vulnerability that allows attackers to write files outside the intended memory root directory by supplying a malicious memory_type value containing path traversal sequences through the remember tool. Attackers can manipulate the memory_type parameter in the persistent memory store to cause the application to write arbitrary Markdown files to unintended locations on the filesystem.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS