Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-114107 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as root by planting instructions in documents or web pages the agent processes. BashTool and BackgroundRunTool pass model-emitted commands to subprocess.run with shell=True and no allow-list or approval step, and read_url fetches arbitrary URLs, enabling command execution and server-side request forgery.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:8.8 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CNA: [email protected]CVSS-B:8.8 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/HKUDS/Vibe-Trading/security/advisories/GHSA-jqmf-mx4f-hfr6	[email protected]	AdvisoryBundleExploitRemedyTechnical AnalysisVendor
https://www.vulncheck.com/advisories/hkuds-vibe-trading-0.1.0-before-0.1.7-indirect-prompt-injection-rce-via-bashtool-and-backgroundruntool	[email protected]	Advisory

Weakness Enumeration

No weakness enumeration is available for this CVE.

Affected Products

Product	Versions
HKUDS Vibe-Trading	>= 0.1.0, < 0.1.7 (semver)
CPE No CPEs found in CPE dictionary for this product. Remediation Upgrade: 0.1.7moderate effort

Change History

2 change records found show changes

Date	Action	Recorded By
Oct 22, 2026	CVE Modified	CISA-ADP
Oct 21, 2026	New CVE Received	[email protected]