Executive brief
Vibe-Trading is an algorithmic trading platform used to manage and execute financial trades. A security flaw allows an authorized user to bypass trading safeguards by tricking the system into loading a malicious configuration file. This could allow an attacker to override trading limits and mandates, potentially leading to unauthorized financial transactions or significant operational disruption.
Technical details
A path traversal vulnerability exists in Vibe-Trading's mandate commitment logic (agent/src/live/mandate/commit.py). The application constructs file paths by joining a user-supplied 'proposal_id' with the broker proposals directory without proper sanitization. An authenticated attacker can use traversal sequences (e.g., ../) to point the application to an arbitrary JSON file on the filesystem. If combined with a file upload capability, an attacker can upload a malicious mandate and then force the system to 'commit' it as an authoritative trading mandate. This bypasses 'ceilings' validation and allows full control over the active trading profile. The issue is fixed in version 0.1.10 by enforcing a strict regex-based format for identifiers and verifying path containment.
Affected products
- HKUDS Vibe-Trading < 0.1.10
Timeline
- 2026-06-18: patched: Fix merged in PR #256
- 2026-06-19: advisory: Release v0.1.10 published
- 2026-06-30: disclosed: CVE-2026-58170 published
References
- https://github.com/HKUDS/Vibe-Trading/commit/0ab701302f90e701c9dc558a898a217a376610c3
- https://github.com/HKUDS/Vibe-Trading/pull/256
- https://github.com/HKUDS/Vibe-Trading/releases/tag/v0.1.10
- https://www.vulncheck.com/advisories/vibe-trading-path-traversal-in-proposal-identifier-allows-forging-live-trading-mandates