Prompt injection flaw lets attackers run root commands in Vibe-Trading

A vulnerability in HKUDS Vibe-Trading, disclosed in the US National Vulnerability Database on 21 October 2026, allows remote attackers to run shell commands as root on machines running the agent. The flaw is tracked as CVE-2026-114107 and affects versions from 0.1.0 before 0.1.7. According to the NVD entry, attackers trigger it by planting instructions in documents or web pages that the agent processes.

This is an indirect prompt injection: the attacker does not talk to the agent directly, but hides instructions in content the agent reads on someone else's behalf. The agent treats that content as if it were a legitimate instruction from its operator. In this case, the end result is command execution on the host with root privileges, the highest level of access on a Unix-like system.

The NVD description points to the specific design decisions that make the injection so damaging. Two components, BashTool and BackgroundRunTool, pass commands produced by the language model to Python's subprocess.run with shell=True. That setting hands the command string to the system shell for interpretation, which means shell features such as command chaining and redirection are available to whatever the model emits. The NVD entry states there is no allow-list restricting which commands can run, and no approval step requiring a human to confirm them before execution.

A third component compounds the problem. According to the NVD, a read_url function fetches arbitrary URLs. That enables server-side request forgery, in which an attacker uses the server as a proxy to reach systems it can contact but the attacker cannot, such as internal network addresses or cloud metadata services. It also provides a route for poisoned content to reach the agent in the first place.

The combination described by the NVD is a well-worn pattern in agent security. An agent that reads untrusted external content and also holds an unrestricted ability to act on the host has no boundary between the two. Any attacker who can get text in front of the agent effectively inherits the agent's permissions.

The NVD record lists two references: a GitHub security advisory published by HKUDS under the identifier GHSA-jqmf-mx4f-hfr6, and an advisory from VulnCheck describing the issue as an indirect prompt injection leading to remote code execution via BashTool and BackgroundRunTool. The incident record derived from these sources rates the severity at 4 and marks the status as confirmed. The vulnerability was recorded as discovered on 21 October 2026.

The affected range ends before 0.1.7, which indicates that version 0.1.7 is the first release outside the vulnerable range. The sources do not describe any exploitation in the wild, and do not say how many deployments are affected. Operators running Vibe-Trading in the 0.1.0 to 0.1.6 range should check the vendor advisory on GitHub for upgrade guidance.