HKUDS Vibe-Trading Indirect Prompt Injection Vulnerability

Executive Summary

CVE-2026-114107 is an indirect prompt injection vulnerability in HKUDS Vibe-Trading versions 0.1.0 to 0.1.7. It allows remote attackers to execute shell commands as root by embedding malicious instructions in documents or web pages processed by the AI agent. The vulnerability stems from BashTool and BackgroundRunTool passing model-emitted commands to subprocess.run with shell=True and no input validation, enabling command injection. Additionally, read_url fetches arbitrary URLs without validation, allowing server-side request forgery.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect the Vibe-Trading application for versions 0.1.0 to 0.1.6. Check if BashTool or BackgroundRunTool are enabled and if they use subprocess.run with shell=True without input validation. Review logs for unexpected shell commands or outbound URL fetches from read_url. Look for unauthorized Python module execution in the backtest runner.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to execute arbitrary shell commands with root privileges on systems running vulnerable versions of HKUDS Vibe-Trading. Attackers can gain full control over the affected system, install malware, exfiltrate data, or pivot to other systems in the network. The lack of authentication requirements for tool access increases the risk of remote exploitation.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements under GDPR and HIPAA due to unauthorized root-level access and potential data breaches. GDPR mandates strict data protection and breach notification, while HIPAA requires safeguards for protected health information. A successful exploit could lead to unauthorized data access, triggering mandatory breach reporting and significant fines.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Vibe-Trading to version 0.1.7 or later. Disable BashTool and BackgroundRunTool if not required. Implement strict input validation for all LLM-generated commands and URLs. Disable auto-discovery of tools by the LLM agent. Restrict outbound network access for the application to prevent SSRF.

Useful 0 Not Useful 0