PT-2026-53922 · Hkuds · Vibe-Trading

Publicado 2026-06-30 · Atualizado 2026-06-30 · CVE-2026-58171

Mitre

CVSS v3.1

4.2

Média

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

Vibe-Trading before 0.1.10 constructs the swarm run directory by joining a caller-supplied run identifier onto the runs base directory without validation in run dir (agent/src/swarm/store.py). A crafted run identifier supplied through the MCP swarm tools causes the application to read arbitrary run.json files outside the runs directory and to overwrite existing run.json files at traversed locations.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-58171

Produtos afetados

Vibe-Trading

Referências · 5

• https://github.com/HKUDS/Vibe-Trading/pull/258 · Nota
• https://github.com/HKUDS/Vibe-Trading/commit/f45fd85392f07b5e404e41d4fcb0ef0d6c2f87ab · Correção
• https://github.com/HKUDS/Vibe-Trading/releases/tag/v0.1.10 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-58171 · Nota de Segurança
• https://vulncheck.com/advisories/vibe-trading-path-traversal-via-swarm-run-identifier · Nota