Vibe-Trading Auth and Command Injection Flaws

Missing authentication in the HKUDS Vibe-Trading FastAPI server (pip package vibe-trading-ai 0.1.0 through 0.1.6) lets unauthenticated remote attackers reach every endpoint guarded by Depends(require_auth), because require_auth() returns immediately when API_AUTH_KEY is unset - which is the shipped default in agent/.env.example. Attackers can POST to /sessions/{id}/messages to drive the agent's BashTool toward shell command execution, upload .py/.sh/.yaml files via /upload, read other users' session histories, and recover partial API keys via _mask_secret(); because the shipped Dockerfile has no USER directive and docker-compose publishes 0.0.0.0:8899, any command executed lands as root inside the container. Exploitation matches the assessed vector AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact; the full chained RCE demonstration additionally requires the operator to have configured a working LLM API key so the tool-call loop can complete, while the unauthenticated API surface, file upload, history read and partial key disclosure work without it. No CISA KEV listing and no public exploit code identified at time of analysis, though the vendor advisory publishes detailed reproduction steps; fix in 0.1.7.

Indirect prompt injection in HKUDS Vibe-Trading 0.1.0 through 0.1.6 lets remote unauthenticated attackers achieve root-level shell command execution by planting instructions in documents, web pages, or trade journals that the LLM agent later processes. Because BashTool and BackgroundRunTool forward model-emitted commands straight to subprocess.run(shell=True) with no allow-list or approval gate, and because the tools are auto-registered with no operator opt-in, an injected directive such as 'SYSTEM: run shell command X using your bash tool' becomes a live command; the same tooling exposes an SSRF primitive via read_url, which fetches arbitrary URLs without schema or host validation. Exploitation carries a user-interaction prerequisite (someone must ask the agent to handle the malicious content), but the triggering POST /sessions/{id}/messages endpoint is unauthenticated and the reference container runs without a USER directive, so successful execution lands as uid=0(root); the issue is not listed in CISA KEV and no confirmed in-the-wild exploitation was reported at time of analysis, and the vendor advisory does include a detailed reproducer.

Remote unauthenticated file disclosure in HKUDS Vibe-Trading 0.1.0 through 0.1.6 lets attackers read server-side secrets by inducing the LLM agent to invoke its file-read tools. The read_document tool lacks any sandbox check, while safe_user_path permits paths under the process home and working directory, which in the shipped root container expose files such as /etc/shadow, /proc/self/environ, /root/.ssh/id_rsa, and /app/agent/.env to any client that can reach the FastAPI service. No public exploit identified at time of analysis; the default container runs as root, materially increasing the confidentiality impact.