# CVE-2026-114107: HKUDS Vibe-Trading indirect prompt injection in BashTool and BackgroundRunTool

Source: https://junglewise.ai/threats/cve-2026-114107-hkuds-vibe-trading-from-0-1-0-before-0-1-7-contains-an-indirect  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-114107 · Severity: high · CVSS 8.8 · Published 2026-10-21

HKUDS Vibe-Trading is an AI agent framework for automated trading that uses large language models to execute system commands and fetch web content. An attacker can inject malicious instructions into documents or web pages the agent processes, causing the LLM to emit shell commands that execute as root with no input validation. This enables complete server compromise, data theft, and lateral movement.

Technologies: [HKUDS Vibe-Trading](https://junglewise.ai/threats/technologies/vibe-trading). Vendors: [HKUDS](https://junglewise.ai/threats/vendors/hkuds).

## Quick answers

**Is CVE-2026-114107 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114107 being exploited in the wild.

**How severe is CVE-2026-114107?** High severity, with a CVSS score of 8.8, published 21 October 2026.

**Which products and versions are affected?** HKUDS Vibe-Trading 0.1.0 before 0.1.7.

**Is there a fix for CVE-2026-114107?** Yes: fixed in 0.1.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-114107 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-114107?** Check whether you run HKUDS Vibe-Trading at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.1.7

## Technical details

An indirect prompt injection vulnerability in BashTool and BackgroundRunTool allows unauthenticated remote attackers to execute arbitrary shell commands as root. The vulnerable components pass LLM-emitted commands directly to subprocess.run(shell=True) without allowlisting, escaping, or validation. An attacker can embed malicious instructions in documents the agent reads or craft prompts that cause the LLM to invoke these tools with injected commands; the vulnerability is reachable over the network via an unauthenticated /sessions API endpoint on port 8899.

## Affected products

- HKUDS Vibe-Trading 0.1.0 before 0.1.7

## Timeline

- 2026-07-29: disclosed
- 2026-10-21: advisory

## References

- [https://github.com/HKUDS/Vibe-Trading/security/advisories/GHSA-jqmf-mx4f-hfr6](https://github.com/HKUDS/Vibe-Trading/security/advisories/GHSA-jqmf-mx4f-hfr6)
- [https://www.vulncheck.com/advisories/hkuds-vibe-trading-0.1.0-before-0.1.7-indirect-prompt-injection-rce-via-bashtool-and-backgroundruntool](https://www.vulncheck.com/advisories/hkuds-vibe-trading-0.1.0-before-0.1.7-indirect-prompt-injection-rce-via-bashtool-and-backgroundruntool)

## Related threats

- [HKUDS Vibe-Trading missing authentication in FastAPI server](https://junglewise.ai/threats/cve-2026-114108-hkuds-vibe-trading-from-0-1-0-before-0-1-7-contains-a-missing)
- [HKUDS Vibe-Trading path traversal in file-read tools](https://junglewise.ai/threats/cve-2026-114106-hkuds-vibe-trading-from-0-1-0-before-0-1-7-contains-a-path)
- [Vibe-Trading FastAPI unauthenticated access and RCE chain](https://junglewise.ai/threats/vibe-trading-fastapi-endpoints-permit-unauthenticated-access-file-1d82990e)
- [HKUDS Vibe-Trading path traversal in persistent memory storage](https://junglewise.ai/threats/cve-2026-58173-hkuds-vibe-trading-path-traversal-in-persistent-memory-storage)
- [HKUDS Vibe-Trading path traversal in swarm run identifier](https://junglewise.ai/threats/cve-2026-58171-hkuds-vibe-trading-path-traversal-in-swarm-run-identifier)