Vibe‑Trading before version 0.1.10 contains a path traversal vulnerability that enables an attacker to supply a malicious memory_type value through the remember tool. The malformed input causes the application to write Markdown files outside the intended memory root directory. This flaw, identified as CWE‑22, allows an attacker to overwrite or create arbitrary files, potentially leading to data tampering or execution of malicious content. The CVSS score of 6.0 reflects a medium severity due to the potential impact on confidentiality and integrity.

The vulnerable product is Vibe‑Trading by HKUDS, affecting all releases earlier than 0.1.10. Systems running these versions are susceptible to exploitation unless they have been upgraded to 0.1.10 or later.

The vulnerability carries a CVSS rating of 6.0, with no EPSS score available and it is not listed in the CISA KEV catalog. Attackers can exploit the flaw by crafting a memory_type string containing traversal sequences; this can be performed remotely if the remember tool’s interface is exposed over a network or locally by any user who can invoke the tool. No additional prerequisites beyond the ability to send the malicious input are stated in the description, so the exploitability is considered moderate to high provided the tool is accessible.