HKUDS Vibe-Trading: Indirect prompt injection leads to remote code execution as root
Summary
Vibe-Trading versions 0.1.0 up to (not including) 0.1.7 let an attacker plant instructions in documents or web pages that the LLM agent processes. The tools BashTool and BackgroundRunTool then pass the model-generated commands unfiltered to a shell, so an attacker can run commands as root, and the read_url tool can be abused for server-side request forgery. No allow-list or approval step exists, and the advisory states the API is reachable without authentication in the default configuration.
Affected
- vibe-trading-ai (PyPI) from 0.1.0 before 0.1.7
Fixed in
- Upgrade to version 0.1.7 or later
Workaround
- No vendor-documented workaround.
- Third-party trackers suggest restricting network access to the Vibe-Trading API to trusted IP addresses until the patch is applied. This does not fix the injection itself.
Exploitation
- CISA SSVC: exploitation none, not automatable.
- Not marked as known exploited in the sources reviewed (not verified against the CISA KEV catalogue).
- No confirmed public exploit found; the advisory describes reproduction steps.
Our recommendation
- Upgrade vibe-trading-ai to version 0.1.7 or later.
- Until patched, restrict access to the API to trusted networks and do not let the agent process untrusted documents or web pages.
- Run the agent as an unprivileged user in a container with egress filtering.
- Review logs for unexpected shell subprocesses and outbound requests.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-jqmf-mx4f-hfr6 github.com
- VulnCheck Advisory www.vulncheck.com
- GitLab Advisory Database (PyPI vibe-trading-ai) advisories.gitlab.com
- PT-2026-111196 (Positive Technologies) vulners.com
- Technical analysis (dev.to) dev.to
- CVE Reports analysis GHSA-JQMF-MX4F-HFR6 cvereports.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 01:07.
Original description (NVD)
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as root by planting instructions in documents or web pages the agent processes. BashTool and BackgroundRunTool pass model-emitted commands to subprocess.run with shell=True and no allow-list or approval step, and read_url fetches arbitrary URLs, enabling command execution and server-side request forgery.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.