CVE-2026-58171: Vibe-Trading Path Traversal Vulnerability in run_dir Function

Technical summary

The vulnerability exists in the run_dir function within agent/src/swarm/store.py, which concatenates a user-supplied run identifier directly onto the runs base directory path without sanitization or validation. No checks prevent directory traversal sequences (e.g., '../') in the run identifier parameter. When the MCP swarm tools invoke this function, a malicious or compromised caller can inject path traversal payloads that escape the intended runs directory boundary. This enables both unauthorized read access to run.json files at traversed paths and write access to overwrite existing files at attacker-controlled locations within the filesystem hierarchy.

Business impact

Exploitation could lead to unauthorized disclosure of sensitive run configuration data or operational state stored in run.json files elsewhere on the system. More critically, an attacker could overwrite existing run.json files to corrupt application behavior, disrupt scheduled tasks, or inject malicious configurations that affect downstream processing. In environments where Vibe-Trading orchestrates critical swarm operations, such tampering could cause operational disruption. The impact is partially mitigated by the requirement for authentication (PR:L in the CVSS vector), limiting exposure to insider threats or compromised service accounts.

Affected systems

Vibe-Trading releases before version 0.1.10 are affected. The vulnerability is reachable only through the MCP swarm tools interface, so systems that expose this functionality to untrusted or insufficiently isolated callers face the highest risk. Development environments, CI/CD pipelines, and multi-tenant deployments where Vibe-Trading coordinates agent workflows are of particular concern.

Exploitability

Exploitation requires authentication (PR:L) and knowledge of the target system's filesystem structure to craft effective traversal payloads, which raises the attack complexity (AC:H). However, the attack vector is network-accessible (AV:N), and no user interaction is required (UI:N). An authenticated insider or an attacker who has compromised a service account with access to MCP swarm tools could exploit this with moderate effort. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog, suggesting no active exploitation in the wild at publication, but the attack surface is real for installations with permissive access controls.

Remediation

Upgrade to Vibe-Trading version 0.1.10 or later, which includes input validation in the run_dir function to reject or sanitize path traversal sequences. Organizations unable to upgrade immediately should restrict network and API access to the MCP swarm tools interface, limit service account privileges, and monitor filesystem access patterns for suspicious read or write operations targeting unexpected run.json file locations.

Patch guidance

Apply the upgrade to version 0.1.10 or later. Verify the patch by reviewing the agent/src/swarm/store.py source code to confirm that the run_dir function now validates run identifiers and rejects traversal patterns. Test in a staging environment to ensure backward compatibility with existing run identifiers and workflows before deploying to production. If version 0.1.10 or later is unavailable, consult the vendor advisory for temporary mitigations or backported security fixes.

Detection guidance

Monitor application logs and filesystem audit events for attempts to access or modify run.json files outside the standard runs directory. Look for MCP swarm tool calls with run identifiers containing path traversal sequences (../, .., backslashes, or URL-encoded equivalents). Use file integrity monitoring on run.json files outside the runs base directory to detect unauthorized modifications. In containerized or sandboxed deployments, network segmentation can limit the blast radius by restricting which processes can invoke the MCP swarm tools.

Why prioritize this

Although the CVSS score is moderate (4.2), this vulnerability should be prioritized because it requires only authentication—a lower bar than unauthenticated attacks—and it affects both confidentiality and availability of application state. Path traversal flaws are straightforward to exploit once understood, and insider threats or compromised service accounts are a realistic attack vector. Rapid patching is advised for any Vibe-Trading deployment that orchestrates critical workflows or stores sensitive configuration in run.json files.

Risk score, explained

The CVSS 3.1 score of 4.2 reflects a MEDIUM severity rating. The score is constrained by the requirement for authentication (PR:L) and high attack complexity (AC:H), which account for the need to know filesystem paths and craft valid traversal sequences. However, the network-accessible attack vector (AV:N) and the impact on integrity (file overwrite, I:L) and availability (corruption or denial of access to runs, A:L) ensure the score exceeds low-severity thresholds. Organizations should weigh this baseline score against their own threat model: deployments with strong access controls and low-sensitivity run data may tolerate delayed patching, while those with permissive APIs or high-value configuration data should escalate remediation priority.

Frequently asked questions