PT-2026-53922 · Hkuds · Vibe-Trading

Published 2026-06-30 · Updated 2026-06-30 · CVE-2026-58171

Mitre

CVSS v3.1

4.2

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

Vibe-Trading before 0.1.10 constructs the swarm run directory by joining a caller-supplied run identifier onto the runs base directory without validation in run dir (agent/src/swarm/store.py). A crafted run identifier supplied through the MCP swarm tools causes the application to read arbitrary run.json files outside the runs directory and to overwrite existing run.json files at traversed locations.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-58171

Affected Products

Vibe-Trading

References · 5

• https://github.com/HKUDS/Vibe-Trading/commit/f45fd85392f07b5e404e41d4fcb0ef0d6c2f87ab · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-58171 · Security Note
• https://github.com/HKUDS/Vibe-Trading/pull/258 · Note
• https://github.com/HKUDS/Vibe-Trading/releases/tag/v0.1.10 · Note
• https://vulncheck.com/advisories/vibe-trading-path-traversal-via-swarm-run-identifier · Note