CVE-2026-58171

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-58171

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-58171.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-58171

Published

2026-06-30T15:54:34.326Z

Modified

2026-07-16T03:30:50.201850646Z

Severity

2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

Vibe-Trading < 0.1.10 - Path Traversal via Swarm Run Identifier

Details

Vibe-Trading before 0.1.10 constructs the swarm run directory by joining a caller-supplied run identifier onto the runs base directory without validation in run_dir (agent/src/swarm/store.py). A crafted run identifier supplied through the MCP swarm tools causes the application to read arbitrary run.json files outside the runs directory and to overwrite existing run.json files at traversed locations.

Database specific

{
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58171.json",
    "cna_assigner": "VulnCheck"
}

References

Affected packages

Git / github.com/hkuds/vibe-trading

Affected ranges

Type

GIT

Repo

https://github.com/hkuds/vibe-trading

Events

Introduced

Fixed

54f944743efee7b9cbaaeafb5966c583d0d4ac66

Fixed

f45fd85392f07b5e404e41d4fcb0ef0d6c2f87ab

Database specific

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.1.10"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

v0.*

v0.1.4

v0.1.5

v0.1.6

v0.1.7

v0.1.8

v0.1.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-58171.json"