Is CVE-2026-58170 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-58170 being exploited in the wild.

How severe is CVE-2026-58170?

High severity, with a CVSS score of 8.3, published 30 June 2026.

Is there a fix for CVE-2026-58170?

A patch was published on 2026-06-18: Fix merged in PR #256 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-58170 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-58170?

Check whether you run HKUDS Vibe-Trading at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-58170: HKUDS Vibe-Trading path traversal in mandate proposal identifier

CVE-2026-58170 · Severity: high · CVSS 8.3 · Published 2026-06-30

Vibe-Trading is an algorithmic trading platform used to manage and execute financial trades. A security flaw allows an authorized user to bypass trading safeguards by tricking the system into loading a malicious configuration file. This could allow an attacker to override trading limits and mandates, potentially leading to unauthorized financial transactions or significant operational disruption.

Technologies: HKUDS Vibe-Trading. Vendors: HKUDS.

Quick answers

Is CVE-2026-58170 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-58170 being exploited in the wild.
How severe is CVE-2026-58170?: High severity, with a CVSS score of 8.3, published 30 June 2026.
Which products and versions are affected?: HKUDS Vibe-Trading < 0.1.10.
Is there a fix for CVE-2026-58170?: A patch was published on 2026-06-18: Fix merged in PR #256 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-58170 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-58170?: Check whether you run HKUDS Vibe-Trading at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability exists in Vibe-Trading's mandate commitment logic (agent/src/live/mandate/commit.py). The application constructs file paths by joining a user-supplied 'proposal_id' with the broker proposals directory without proper sanitization. An authenticated attacker can use traversal sequences (e.g., ../) to point the application to an arbitrary JSON file on the filesystem. If combined with a file upload capability, an attacker can upload a malicious mandate and then force the system to 'commit' it as an authoritative trading mandate. This bypasses 'ceilings' validation and allows full control over the active trading profile. The issue is fixed in version 0.1.10 by enforcing a strict regex-based format for identifiers and verifying path containment.

Affected products

HKUDS Vibe-Trading < 0.1.10

Timeline

2026-06-18: patched: Fix merged in PR #256
2026-06-19: advisory: Release v0.1.10 published
2026-06-30: disclosed: CVE-2026-58170 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.