Prompt Injection Grants Root Shell in Vibe-Trading Agent Tool Registry
A high-severity vulnerability (CVE-2026-114107) in HKUDS Vibe-Trading allows remote code execution via prompt injection in processed documents. The agent automatically executes arbitrary shell commands as root without confirmation or input sanitization. Teams running autonomous agents must isolate tool registries and remove default shell execution privileges.
Why it matters
Audit agent tool definitions to ensure untrusted document ingestion turns do not share execution context with root terminal commands.
TL;DR
- 01Never treat LLM discretion as a security boundary between untrusted inputs and command sinks.
- 02Isolate read-only tasks like summarization from privileged OS execution tools.
- 03Always specify a non-root USER directive inside containerized AI agent runtimes.
Key facts
- CVE ID
- CVE-2026-114107
- CVSS 4.0 Score
- 8.7 (High)
- Affected Versions
- 0.1.0 to 0.1.6
- Patched Version
- 0.1.7
- Default User ID
- uid=0 (root)
Vulnerability Overview
Identified as CVE-2026-114107 with a CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H), HKUDS Vibe-Trading versions 0.1.0 through 0.1.6 allowed unauthenticated remote code execution. Because BashTool and BackgroundRunTool passed model-generated strings directly to Python's subprocess.run(..., shell=True) without an allow-list, command parsing, or human confirmation, indirect prompt injection delivered complete container takeover. A related flaw, CVE-2026-114106, exposed arbitrary file reading via path traversal, leaking /proc/self/environ and sensitive API tokens.
Architectural Root Causes
1. Unconditional Shell Discovery: Agent runtimes often auto-register all tools discovered at initialization. A passive summarizing turn was equipped with the same privileged execution primitives as an administrative shell. 2. Absence of Deterministic Barriers: The LLM's judgment served as the sole validation layer before calling the OS sink. Under prompt injection, that boundary completely collapses. 3. Unified Ingestion and Action Turns: Reading untrusted input (PDFs, web articles) occurred in the same context where active system mutations were permitted. 4. Root Execution Blast Radius: Docker containers lacked a non-root USER declaration, executing all commands as uid=0.
Hardening Agent Workflows
Deploying autonomous agents safely requires removing general-purpose shells from default tool registries. Systems must enforce shell=False, restrict outbound network requests in URL-reading tools to avoid Server-Side Request Forgery (SSRF), and isolate untrusted data ingestion into unprivileged, read-only sandboxes.
Try it in 2 minutes
# Enforce non-root execution and drop default shell capabilities in agent containers
RUN useradd -m -u 10001 agentuser
USER agentuser
ENV PYTHONUNBUFFERED=1dockerfile
✓ When to use
- Use when evaluating container isolation and sandboxing for autonomous coding agents.
- Apply when implementing validation boundaries between LLM outputs and backend tools.
✕ When NOT to use
- Do not apply full shell execution capabilities to non-interactive summarization tasks.
- Avoid passing unsanitized LLM strings into shell=True subprocess wrappers.
What to do today
- Upgrade HKUDS Vibe-Trading dependencies to version 0.1.7 or later.
- Audit custom agent code for subprocess.run invocations configured with shell=True.
- Add a non-root USER and strip environment secrets from agent container specifications.