Key points
- HKUDS Vibe-Trading versions prior to 0.1.7 contain CVE-2026-114107.
- The flaw allows remote attackers to run shell commands as root.
- A fix is available in version 0.1.7.
HKUDS Vibe-Trading versions before 0.1.7 are affected by a high-severity vulnerability that allows remote attackers to execute shell commands as root. The issue stems from an indirect prompt injection flaw where attackers plant instructions in documents or web pages processed by the agent. This exposure enables command execution and server-side request forgery through specific tool interactions within the software.
In plain English
The vulnerability exists because the software passes commands directly to the system shell without proper verification. When the AI agent processes external content, it can be tricked into running malicious code. Specifically, features like BashTool and BackgroundRunTool send model-generated commands to subprocess.run with shell privileges enabled. This bypasses safety checks, allowing attackers to control the server completely if they successfully inject prompts into files the agent reads.
The background
The flaw is tracked as CVE-2026-114107 with a CVSS score of 8.7, rated high severity. Weakness CWE-1427 is associated with this indirect prompt injection issue. The vulnerability affects all versions of HKUDS Vibe-Trading starting from 0.1.0 up to, but not including, 0.1.7. Attackers exploit the lack of an allow-list or approval step for commands emitted by the model. Additionally, the read_url function fetches arbitrary URLs, expanding the attack surface for remote exploitation and server-side request forgery attempts.
What changes now
HKUDS has released version 0.1.7 to address this security gap. Users running any version prior to 0.1.7 must upgrade to mitigate the risk of remote code execution. The update likely introduces necessary safeguards to prevent the agent from blindly executing commands derived from external inputs. Until systems are updated, the software remains vulnerable to attackers who can manipulate documents or web pages processed by the agent to gain root-level access to the host machine.
Who needs to act first
Teams should prioritize updating systems exposed to untrusted document sources or public web interfaces first, as these face the highest injection risk. Isolate affected instances from critical networks during the update process to prevent lateral movement if exploitation occurs. Verify that the new version restricts shell command execution and validates all external URLs before processing. Monitor logs for unusual subprocess activity or unexpected network requests during the transition period to ensure the patch effectively blocks the previously observed attack vectors.
What to do and how to stay safe: HKUDS Vibe-Trading
- Update HKUDS Vibe-Trading to version 0.1.7 or later immediately.
- Restrict network access for systems running older versions until patched.
- Monitor logs for unexpected shell commands or outbound connections.
- Review agent configurations to limit processing of untrusted documents.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of HKUDS Vibe-Trading are vulnerable?
All versions from 0.1.0 up to, but not including, 0.1.7 are affected by CVE-2026-114107.
What is the severity of this vulnerability?
The National Vulnerability Database rates CVE-2026-114107 as high severity with a CVSS score of 8.7.
Is there a fix available?
Yes, HKUDS has released version 0.1.7 to address the indirect prompt injection vulnerability.
