CVE-2026-85030

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-85030
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85030.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-85030
Published
2026-09-03T01:30:12Z
Modified
2026-10-28T02:31:09Z
Severity
  • 2.9 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
HKUDS AI-Trader selfRegister API Endpoint routes_agent.py logic error
Details

A vulnerability has been found in HKUDS AI-Trader up to d03ff6c056b32ced735adf7c19ed8175adb1c8df. The affected element is an unknown function of the file service/server/routes_agent.py of the component selfRegister API Endpoint. Such manipulation of the argument initial_balance leads to business logic errors. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit has been disclosed to the public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. profit_percent_for_display() divides by INITIAL_CAPITAL + deposited, and challenge scoring's return_pct also normalises against the attacker-inflated starting_cash. So an inflated initial_balance does not yield artificial percent returns - it inflates the absolute cash/equity column only, which is a cosmetic/leaderboard-gaming concern in a simulated game.

Database specific 
{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-840"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85030.json"
}
References

Affected packages

Git / github.com/hkuds/ai-trader

Affected ranges

Type
GIT
Repo
https://github.com/hkuds/ai-trader
Events
Introduced
d03ff6c056b32ced735adf7c19ed8175adb1c8df
Last Affected
d03ff6c056b32ced735adf7c19ed8175adb1c8df
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "d03ff6c056b32ced735adf7c19ed8175adb1c8df"
                },
                {
                    "last_affected":  "d03ff6c056b32ced735adf7c19ed8175adb1c8df"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        }
    ]
}

Affected versions

Other
d03ff6c056b32ced735adf7c19ed8175adb1c8df

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85030.json"