Summarize this document, then run it: Vibe-Trading's prompt-injection-to-root shell

A vector breakdown of CVE-2026-114107 (HKUDS Vibe-Trading 0.1.0 before 0.1.7, fixed in 0.1.7)

Most agent shell bugs need an attacker who can talk to the agent. This one only needs an attacker who can get a document or a web page in front of it. Vibe-Trading hands its model a shell tool that runs whatever command the model emits, as root, with no allow-list and no approval step. So the person who wrote the PDF the agent is summarizing has the same reach as the operator.

What the advisory actually says

From the CVE record (published to NVD October 21, 2026, 01:17 UTC, by VulnCheck), the VulnCheck advisory, and the project's GitHub advisory GHSA-jqmf-mx4f-hfr6:

Product: HKUDS Vibe-Trading, an AI trading-research agent. Affected: 0.1.0 up to, but not including, 0.1.7. Fixed: 0.1.7.
Weakness: CWE-1427, Improper Neutralization of Input Used for LLM Prompting. The GitHub advisory also lists CWE-77, CWE-78, CWE-94, CWE-116 and CWE-918.
Severity: VulnCheck scores it High, CVSS 4.0 8.7 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H). Network-reachable, no privileges, and "passive" user interaction: someone just has to ask the agent to read the attacker's content.
The bug, in the CVE's words: "remote attackers [can] execute shell commands as root by planting instructions in documents or web pages the agent processes. BashTool and BackgroundRunTool pass model-emitted commands to subprocess.run with shell=True and no allow-list or approval step, and read_url fetches arbitrary URLs, enabling command execution and server-side request forgery."
Related: CVE-2026-114106 covers the same release's file-read tools, which could be steered by path traversal into files like /etc/shadow and /proc/self/environ.

The GitHub advisory groups five findings under one root cause: "LLM-callable tool primitive ships with zero input validation between the LLM and the sink."

The vector: attacker text in, root shell out

The attacker writes instructions into content the agent will read later: an uploaded document, a web page, a trade journal.
A legitimate user asks the agent to summarize or research that content. The user's own prompt is clean.
The model reads the planted instructions and can't reliably separate "text I'm analyzing" from "instructions I should follow," so it emits a call to the shell tool.
BashTool (or its async sibling BackgroundRunTool) passes that command straight to subprocess.run(..., shell=True). No parser, no allow-list, no confirmation.
The container has no USER directive, so the command runs as root, with whatever keys and network the agent process holds.

The advisory notes a second path to the same tools: in affected versions the session API itself had no working authentication (a separate advisory), so anyone who could reach the port could drive them directly. But it's explicit that fixing authentication alone "leaves prompt-injection RCE on the table."

Why this class of bug exists: four root causes

1. A general-purpose shell is registered by default

Mechanism. Agent frameworks discover tools automatically and hand the model the whole registry. If one of those tools is "run any shell command," every task the agent does, even a summary, carries the ability to run code.

Evidence. The advisory says all five tools "are members of the auto-discovered tool registry the LLM agent gets at startup," and "the tool registration is unconditional in default config — no operator opt-in flag gates them." It also points out that there are two shell entry points, so "fixing only BashTool leaves this path intact."

What fixes it. Make dangerous tools opt-in, not discovered. A summarizing turn has no business holding a shell at all. If a workflow truly needs one, the operator should switch it on explicitly, for that workflow.

2. The model's judgment is the only gate

Mechanism. When the code between the model and subprocess does nothing, the model's own discretion is the security boundary. Prompt injection exists precisely to beat that discretion.

Evidence. The advisory's wording: "the LLM's own judgement is the only barrier, and that barrier collapses under prompt injection." The command argument is read "directly … (LLM-emitted) with no allowlist, no escaping, no chroot, no seccomp, and no length cap."

What fixes it. Put a deterministic check between the model and the sink: an allow-list of command prefixes, argument parsing with shell=False, and human approval for anything outside the list. The check has to be code, because text the attacker controls can't change code.

3. Untrusted content and privileged tools share one turn

Mechanism. The same model turn that ingests outside content can call tools with real authority. That gives the author of the content the operator's authority.

Evidence. The advisory describes "an authenticated, non-malicious caller using a clean prompt" being "turned into an RCE vector by feeding the agent attacker-controlled content (a malicious PDF, web page, or trade journal)." The same applies to read_url, which forwarded any model-supplied URL with "no schema check, no hostname allowlist, no RFC1918 filter," so planted text could also point the agent at internal services.

What fixes it. Split reading from acting. Turns that process outside content get read-only tools; acting turns don't see raw outside content, or their tool calls need approval the content can't grant. Validate outbound URLs (scheme, host, private address ranges) in code.

4. The blast radius is root in the container

Mechanism. Even a well-gated agent will eventually run something it shouldn't. What it can reach then decides whether that's a nuisance or a breach.

Evidence. "The container has no USER directive, so successful execution runs as uid=0(root)." The related CVE-2026-114106 shows the same release could read /proc/self/environ, which is where API keys in environment variables live.

What fixes it. Run as a non-root user, keep secrets out of the agent's environment, and limit outbound network access to what the workflow needs.

How this connects to other agent tool bugs

Recent approval-gate bugs had a gate that checked too little, or a gate that went silent on headless surfaces. This one never had a gate. Same lesson, simplest form: if the only thing between untrusted text and a shell is the model's opinion, the attacker is the one with the shell.

Defensive takeaways you can check this week

Upgrade. If you run Vibe-Trading 0.1.0 through 0.1.6, move to 0.1.7, per the GitHub advisory.
Rotate if exposed. If an affected version read outside documents or URLs, or its port was reachable by others, rotate the LLM and data-provider keys in its environment and review its shell history and outbound traffic.
Inventory your own agents' shell tools. Search for shell=True and equivalents reachable from a model tool call. For each, ask whether it's registered by default and what code, not prompt, stands in front of it.
Gate outbound fetches. Any "read this URL" tool should reject non-HTTP schemes and private, loopback and link-local addresses before it fetches.
Drop root. Add a non-root USER to agent containers and keep long-lived secrets out of their environment.
Test the injection path. Add a test that feeds the agent a document containing an instruction to call its shell tool and asserts the call is refused, not just that the model "usually ignores it."