CVE-2026-58170

Vibe-Trading before 0.1.10 builds the proposal file path by joining a caller-supplied proposal identifier onto the broker proposals directory without sanitization (agent/src/live/mandate/commit.py). A proposal identifier containing path traversal sequences causes the application to load an attacker-controlled JSON file as an authoritative live trading mandate. Combined with the file upload endpoint, an admitted caller can write a JSON file to a known location and traverse to it, and because the ceilings validation is skipped when ceilings are absent, the attacker fully controls the committed mandate.

• CWE-22

• https://github.com/HKUDS/Vibe-Trading/commit/0ab701302f90e701c9dc558a898a217a376610c3
• https://github.com/HKUDS/Vibe-Trading/pull/256
• https://github.com/HKUDS/Vibe-Trading/releases/tag/v0.1.10
• https://www.vulncheck.com/advisories/vibe-trading-path-traversal-in-proposal-identifier-allows-forging-live-trading-mandates
• https://github.com/HKUDS/Vibe-Trading/pull/256

Published

Jun 30, 2026

Last Modified

Jul 14, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-58165OpenZiti through 2.0.0, fixed in commit 3027fdf, contains a …8.8
• CVE-2026-58166OpenBMB ChatDev through 2.2.0, fixed in commit 4fd4da6, cont…9.1
• CVE-2026-58167Nightingale (n9e) before 9.0.0-beta.2 exposes full datasourc…7.1
• CVE-2026-58168DeepTutor before version 1.4.10 contains an authorization by…8.8
• CVE-2026-58169Vibe-Trading before 0.1.10 contains a DNS rebinding authenti…7.7
• CVE-2026-5817The vllm-metal inference backend in Docker Model Runner on m…8.6
• CVE-2026-58171Vibe-Trading before 0.1.10 constructs the swarm run director…4.2
• CVE-2026-58172Ocelot through 24.1.0, fixed in commit f156fd4, contains a s…9.3
• CVE-2026-58173Vibe-Trading before 0.1.10 contains a path traversal vulnera…6.5
• CVE-2026-58174Hermes WebUI before 0.51.521 validates the workspace of an i…6.5
• CVE-2026-58175Apache Traffic Server leaks memory when handling HostDB SRV …8.2
• CVE-2026-58176RuoYi-Vue-Plus through 5.6.2, fixed in commit 88d03d9, expos…7.1