CVE-2026-114106

37th percentile - higher than 37% of all known CVEs

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability that allows remote attackers to read sensitive server files through LLM agent file-read tools. Attackers can prompt the agent to invoke read_document, which lacks sandbox checks, or safe_user_path-gated tools to leak /etc/shadow, /proc/self/environ API keys, and /root credentials.

An attacker can access critical system files and credentials, leading to full server compromise and privilege escalation. Organizations using this tool are exposed to leakage of API keys and passwords.

Update HKUDS Vibe-Trading to version 0.1.7 or later. Additionally, restrict the agent process privileges and apply the principle of least privilege.