What happened
Verified via VulnCheck/NVD and the GitHub advisory (fetched): a single advisory set covers unsandboxed LLM-callable BashTool/BackgroundRunTool shell injection (the canonical RCE primitive) plus backtest exec_module and Jones codegen sinks, SSRF in read_url, read-document path traversal (CVE-2026-114106, 7.5), indirect prompt injection to root shell (CVE-2026-114107, 8.8), and missing authentication on the FastAPI surface (CVE-2026-114108, 9.8) making everything reachable anonymously.
Why it matters
The finding is a textbook demonstration of the recurring LLM-tool RCE class in a trading agent: unauthenticated request or prompt-injected PDF → root shell, and unauthenticated arbitrary file read of API keys/credentials — layered in one framework released to PyPI.
Attack vector
Unauthenticated POST to /sessions/{id}/messages (require_auth() returns early when API_AUTH_KEY is unset) or uploading a document/web page containing embedded instructions; the LLM agent then calls BashTool/BackgroundRunTool, which pass model-emitted commands verbatim to subprocess.run(shell=True) as root. Separately, the read_document file tool lacks sandbox checks (and safe_user_path-gated tools escape), enabling arbitrary server-file reads such as /etc/shadow and process env containing API keys.
Affected systems
HKUDS Vibe-Trading (vibe-trading-ai) 0.1.0 – <0.1.7
Mitigation
Upgrade to 0.1.7; set API_AUTH_KEY; add a USER directive / non-root runtime; restrict or remove file tools; treat any document processed by the agent as untrusted input. Advisories: GHSA-jqmf-mx4f-hfr6, GHSA-5rmq-chc7-m22f, GHSA-v2f8-6655-7grj.