CVE-2026-58171

Medium

Description

Vibe-Trading before 0.1.10 constructs the swarm run directory by joining a caller-supplied run identifier onto the runs base directory without validation in run_dir (agent/src/swarm/store.py). A crafted run identifier supplied through the MCP swarm tools causes the application to read arbitrary run.json files outside the runs directory and to overwrite existing run.json files at traversed locations.

SeverityMedium

CVSS4.2

Exploit probability—

ProductVibe-Trading

PublishedJun 30, 2026

First seenJun 30, 2026

Weakness typeCWE-22Path traversal

How to fix

Update

HKUDS Vibe-Trading0.1.10 or later

Patches

github.com/HKUDS/Vibe-Trading/commit/f45fd85392f07b5e404e41d4fcb0ef0d6c2f87ab

Vendor advisories

github.com/HKUDS/Vibe-Trading/releases/tag/v0.1.10

Affected products

Product	Affected versions	Fixed in
HKUDS Vibe-Trading	v < 0.1.10	0.1.10

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.