Back to overview

CVE-2026-58171

MEDIUM
4.2
CVSS 3.1
Description
Vibe-Trading before 0.1.10 constructs the swarm run directory by joining a caller-supplied run identifier onto the runs base directory without validation in run_dir (agent/src/swarm/store.py). A crafted run identifier supplied through the MCP swarm tools causes the application to read arbitrary run.json files outside the runs directory and to overwrite existing run.json files at traversed locations.

Metadata

CVE ID
CVE-2026-58171
State
PUBLISHED
Assigner
VulnCheck
Reserved
2026-06-29 16:03 UTC
Published
2026-06-30 15:54 UTC
Last updated
2026-06-30 17:13 UTC
Primary CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory …
Vendor / Product
HKUDS / Vibe-Trading
Sources
cve.org  ·  NVD

Severity & Metrics

4.2 MEDIUM CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
SSVC — CISA Coordinator
Exploitation
none
Automatable
no
Tech. Impact
partial
Affected products (1)
VendorProductPlatformVersions
HKUDS Vibe-Trading — 0 < 0.1.10
Weakness (CWE)
CWESourceDescription
CWE-22 cna Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSS scores (2)
ScoreSeverityVersionSourceVector
4.2 MEDIUM 3.1 cna CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
2.3 LOW 4.0 cna CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
References (4)
Back to overview