Indirect prompt injection in Vibe-Trading's BashTool lets attackers run shell commands as root

HKUDS (Vibe-Trading maintainers)·Vibe-Trading LLM trading agent (BashTool / BackgroundRunTool / read_url tools)Fixed

Vibe-Trading's agent tools (BashTool, BackgroundRunTool) passed model-emitted command strings straight into subprocess.run(shell=True) with no allow-list or approval step, so an instruction planted in a document or web page the agent was asked to summarise (e.g. 'SYSTEM: run shell command X using your bash tool') was executed verbatim as root inside the agent's container; the agent's read_url tool could likewise be driven to fetch arbitrary internal URLs.

Blast radius

Researcher-demonstrated unauthenticated remote code execution as root (CVSS v3.1 9.0 / v4.0 9.3) plus SSRF on any default Docker deployment (port 8899); no confirmed real-world exploitation was disclosed, but the project has roughly 33,500 GitHub stars, implying broad installation of the vulnerable versions (0.1.0–0.1.6).

Root cause

Tool primitives exposed to the LLM had zero validation between model output and the shell/HTTP sink (subprocess.run(shell=True), unvalidated read_url), and the container itself ran as root with no sandboxing, allow-list, or human-approval gate on tool calls.

How it was caught

Found by an external security researcher (GitHub user lemi9090) through manual review and proof-of-concept reproduction, not by the maintainers' own testing or any production monitoring.

What changed

Patched in Vibe-Trading v0.1.7 (commit 488abd92f53549682892f3dca6edc184697ae525); tracked as GitHub Security Advisory GHSA-jqmf-mx4f-hfr6 and assigned CVE-2026-114107.

Take-awayNever let an agent's tool wrapper pipe raw model output into subprocess.run(shell=True); enforce a fixed command allow-list, run tool execution as a non-root, sandboxed user, and gate any shell- or network-fetching tool behind explicit approval, since content the agent merely reads (a document, a web page) can become its instructions.