Which versions of Vibe Trading are affected by CVE-2026-58170?

HKUDS Vibe-Trading versions before 0.1.10 contain a trading mandate forgery vulnerability that allows low-privileged authenticated users to execute unauthorized live trades.. A patch is available.

How to fix or mitigate CVE-2026-58170?

Within 24 hours: Identify all HKUDS Vibe-Trading deployments and confirm version numbers currently in use. Within 7 days: Upgrade all instances to version 0.1.10 or later and validate that trading mandate validation is functioning correctly. Within 30 days: Conduct a historical review of trading activity from the preceding 90 days to identify and remediate any unauthorized mandates or suspicious trading patterns.

Vibe Trading CVE-2026-58170

Q: What is the CVSS score of CVE-2026-58170?

CVE-2026-58170 has a CVSS 4.0 base score of 7.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-40351 HIGH

Path Traversal (CWE-22)

2026-06-30 VulnCheck

GHSA-h9xw-f6mh-953j

Path Traversal File Upload Vibe Trading

7.2

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Network-reachable mandate-commit flow with low complexity but requires an admitted caller (PR:L); impact is integrity/availability of trading (I:H/A:H) with no data disclosure (C:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 30, 2026 - 17:37 vuln.today

Analysis Updated

Jun 30, 2026 - 17:37 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 17:36 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 30, 2026 - 17:22 vuln.today

cvss_changed

CVSS changed

Jun 30, 2026 - 17:22 NVD

8.3 (HIGH) 7.2 (HIGH)

Analysis Generated

Jun 30, 2026 - 17:17 vuln.today

DescriptionCVE.org

Vibe-Trading before 0.1.10 builds the proposal file path by joining a caller-supplied proposal identifier onto the broker proposals directory without sanitization (agent/src/live/mandate/commit.py). A proposal identifier containing path traversal sequences causes the application to load an attacker-controlled JSON file as an authoritative live trading mandate. Combined with the file upload endpoint, an admitted caller can write a JSON file to a known location and traverse to it, and because the ceilings validation is skipped when ceilings are absent, the attacker fully controls the committed mandate.

AnalysisAI

Trading mandate forgery in HKUDS Vibe-Trading before 0.1.10 lets an admitted (low-privileged) caller supply a proposal identifier containing path traversal sequences so the application loads an attacker-controlled JSON file as an authoritative live trading mandate. Because ceiling/limit validation is skipped when ceilings are absent, the attacker fully controls the committed mandate, enabling unauthorized live trades. …