HKUDS Vibe‑Trading versions 0.1.0 through 0.1.6 contain an indirect prompt injection vulnerability that enables attackers to execute arbitrary shell commands with root privileges. The flaw arises when the BashTool and BackgroundRunTool components pass model‑generated command strings to subprocess.run with shell=True without any allow‑list or approval step. Additionally, read_url can retrieve arbitrary URLs, providing a path for server‑side request forgery. This weakness is classified as CWE‑1427 and can be exploited by injecting crafted instructions into documents or web pages that the agent processes, resulting in remote code execution and full control over the host.

HKUDS Vibe‑Trading, versions 0.1.0 to 0.1.6 inclusive (before 0.1.7). The vulnerability applies to the Vibe‑Trading product distributed by HKUDS.

The CVSS score of 8.7 marks the flaw as High severity. The EPSS score of less than 1% indicates a low probability of exploitation in the near term, but the lack of a known exploit does not diminish the risk due to the high impact. The vulnerability is not listed in the CISA KEV catalog. Remote code execution can be achieved by injecting malicious content into documents or web pages that the Vibe‑Trading agent processes; the attacker does not need direct server access beyond the ability to provide the arbitrary content. The attack vector is remote, and a successful exploit would grant an attacker root privileges on the affected host.