Medium severity · published Jun 30, 2026
CVE-2026-58171
Vibe-Trading < 0.1.10 - Path Traversal via Swarm Run Identifier
4.2
CVSS
0.3%
EPSS
No
On KEV
Description
Vibe-Trading before 0.1.10 constructs the swarm run directory by joining a caller-supplied run identifier onto the runs base directory without validation in run_dir (agent/src/swarm/store.py). A crafted run identifier supplied through the MCP swarm tools causes the application to read arbitrary run.json files outside the runs directory and to overwrite existing run.json files at traversed locations.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VI
Vibe-Trading · HKUDS
before 0.1.10 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-58171
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-58171
github.com
https://github.com/HKUDS/Vibe-Trading/commit/f45fd85392f07b5e404e41d4fcb0ef0d6c2f87ab
github.com
https://github.com/HKUDS/Vibe-Trading/pull/258
github.com
https://github.com/HKUDS/Vibe-Trading/releases/tag/v0.1.10
www.vulncheck.com
https://www.vulncheck.com/advisories/vibe-trading-path-traversal-via-swarm-run-identifier
More from Vibe-Trading
9.8
CVE-2026-114108
HKUDS Vibe-Trading before 0.1.7 Missing Authentication in FastAPI Server Enabling RCE
8.8
CVE-2026-114107
HKUDS Vibe-Trading 0.1.0 before 0.1.7 Indirect Prompt Injection RCE via BashTool and BackgroundRunTool
8.3
CVE-2026-58170
Vibe-Trading < 0.1.10 - Path Traversal in Proposal Identifier Allows Forging Live Trading Mandates
7.5
CVE-2026-114106
HKUDS Vibe-Trading 0.1.0 before 0.1.7 Path Traversal via read_document and safe_user_path
7.5
CVE-2026-58169
Vibe-Trading < 0.1.10 - Loopback Trust and Missing Host Validation Enable DNS-Rebinding Authentication Bypass and Remote Code Execution