CVE-2026-114106 HKUDS Vibe-Trading 0.1.0 before 0.1.7 Path Traversal via read_document and safe_user_path
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-114106?
CVE-2026-114106 is a high-severity vulnerability in HKUDS Vibe-Trading, published on 21 Oct 2026.
Official description
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability that allows remote attackers to read sensitive server files through LLM agent file-read tools. Attackers can prompt the agent to invoke read_document, which lacks sandbox checks, or safe_user_path-gated tools to leak /etc/shadow, /proc/self/environ API keys, and /root credentials.
Weakness: CWE-22
Which versions are affected by CVE-2026-114106?
2 open source packages ship an affected version, including vibe-trading-ai.
| Package | Affected | Fixed in |
|---|---|---|
vibe-trading-ai PyPI | From 0.1.0 | 0.1.7 |
vibe-trading-ai PyPI | From 0.1.0 | 0.1.7 |
How do I fix CVE-2026-114106?
Upgrade vibe-trading-ai to 0.1.7 or later.
Is CVE-2026-114106 being exploited?
There is no known exploitation of CVE-2026-114106 in the wild and no public exploit code.
Sources
Also known as GHSA-5rmq-chc7-m22f, GHSA-c5xj-9gp4-c84p.