What’s Vulnerable › Vulnerabilities

CVE-2026-58171: Vibe-Trading < 0.1.10 - Path Traversal via Swarm Run Identifier

• Severity: medium (CVSS 4.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-30 · updated 2026-10-25
• Weakness: CWE-22

Description

Vibe-Trading before 0.1.10 constructs the swarm run directory by joining a caller-supplied run identifier onto the runs base directory without validation in run_dir (agent/src/swarm/store.py). A crafted run identifier supplied through the MCP swarm tools causes the application to read arbitrary run.json files outside the runs directory and to overwrite existing run.json files at traversed locations.

Affected products

• HKUDS Vibe-Trading: before 0.1.10 — fixed in 0.1.10

How to fix

Upgrade to a fixed version: HKUDS Vibe-Trading 0.1.10. Check the vendor advisory for mitigations.

References

• https://github.com/HKUDS/Vibe-Trading/commit/f45fd85392f07b5e404e41d4fcb0ef0d6c2f87ab
• https://github.com/HKUDS/Vibe-Trading/pull/258
• https://github.com/HKUDS/Vibe-Trading/releases/tag/v0.1.10
• https://www.vulncheck.com/advisories/vibe-trading-path-traversal-via-swarm-run-identifier

Get alerted when CVE-2026-58171 or the next vulnerability affects your stack