GHSA-5RMQ-CHC7-M22F: Arbitrary File Read and Path Traversal in Vibe-Trading Platform

The Vibe-Trading platform is an open-source algorithmic trading and multi-agent execution workspace. In versions prior to 0.1.7, the platform registers and auto-discovers various file-reading tools designed to allow automated LLM agents to parse localized trading logs, CSV transaction journals, and strategy configuration documents.\n\nThese tools are exposed over the network via unauthenticated HTTP endpoints on the default API port 8899. Because the default Docker container deployment lacked a USER instruction, the underlying FastAPI server executed processes with root privileges (uid=0). This combination of factors allows remote attackers to interact with the LLM agent and prompt the system to access arbitrary paths.\n\nThe vulnerability manifests as two distinct findings, designated Finding 9 and Finding 10. Finding 9 concerns a logical failure in the path validation envelope which permits access to critical system directories. Finding 10 involves a total omission of path validation checks in the primary document parsing tool.\n\nTogether, these issues form a severe exposure channel. Attackers can leverage the vulnerabilities to bypass local monitoring, exfiltrate sensitive API tokens, and access administrative credentials without authentication.

The root cause of Finding 9 resides in agent/src/tools/path_utils.py within the safe_user_path function. The utility was designed to verify that files requested by the agent remained within either the user's home directory or the current working directory. It used the following comparison structure:\n\npython\nhome = Path.home().resolve()\ncwd = Path.cwd().resolve()\nif resolved.is_relative_to(home) or resolved.is_relative_to(cwd):\n return resolved\n\n\nBecause the containerized application runs as root, Path.home() evaluates to /root and Path.cwd() evaluates to /app. Under this logic, any file residing within /root or /app is accepted as a valid path. This encompasses highly sensitive locations such as /root/.ssh/, /root/.aws/, and /app/agent/.env.\n\nFinding 10 represents a complete failure of input validation within agent/src/tools/doc_reader_tool.py. The read_document function accepts a file_path string parameter and initializes a standard Path object. It checks if the file exists and is a regular file, but fails to execute any sanitization or boundary verification before returning the file content to the caller.\n\nBecause DocReaderTool is exposed to the LLM engine, a remote user can query the session interface and specify arbitrary absolute paths such as /etc/shadow or /proc/self/environ. The lack of check boundaries allows direct reads outside the intended application directory structure.

The vulnerability is illustrated by the following comparisons between the insecure and secure implementations.\n\nIn the vulnerable version of the path check utility, the code relies on the local environment boundaries which inadvertently expand to root-owned directories:\n\npython\n# VULNERABLE: agent/src/tools/path_utils.py\ndef safe_user_path(p: str) -> Path:\n resolved = Path(p).resolve()\n # When running as root, home is /root, cwd is /app\n if resolved.is_relative_to(Path.home()) or resolved.is_relative_to(Path.cwd()):\n return resolved\n raise ValueError("Path is outside allowed directories")\n\n\nThe patched implementation completely removes the reliance on Path.home() and Path.cwd(). It implements an explicit allowlist restricted to designated data, upload, and runtime folders:\n\npython\n# PATCHED: agent/src/tools/path_utils.py\ndef _default_file_roots() -> list[Path]:\n cwd = Path.cwd().resolve()\n home = Path.home().resolve()\n agent_root = _agent_root()\n return [\n agent_root / "uploads",\n agent_root / "runs",\n cwd / "uploads",\n cwd / "data",\n home / ".vibe-trading" / "uploads",\n home / ".vibe-trading" / "imports",\n ]\n\n\nAdditionally, the document reader tool was updated to ensure that no file read is initiated without passing through the newly implemented path validation utility:\n\npython\n# PATCHED: agent/src/tools/doc_reader_tool.py\ndef read_document(file_path: str, pages: str = "") -> str:\n try:\n # Added strict validation envelope call\n path = safe_document_path(file_path)\n except ValueError as exc:\n return _err(str(exc))\n

An exploitation sequence against an unpatched instance requires no pre-existing session state or authentication. The following sequence demonstrates how an attacker executes a targeted retrieval of sensitive environment secrets.\n\nmermaid\ngraph LR\n A["Attacker API Request"] --> B["FastAPI Endpoint (Port 8899, UID 0)"]\n B --> C["Agent Session Thread"]\n C --> D["DocReaderTool.read_document()"]\n D --> E["Arbitrary System Path (/proc/self/environ)"]\n E --> D\n D --> C\n C --> B\n B --> A\n\n\nFirst, the attacker initializes a session with the API gateway by sending a POST request to /sessions. This generates a unique identifier for tracking state. Secondly, the attacker issues a message within the newly created session. The prompt directs the agent to locate, read, and summarize the contents of the local environment pseudo-file.\n\nbash\ncurl -s -X POST "http://target:8899/sessions/sess_example/messages" \\\n -H "Content-Type: application/json" \\\n -d '{"content":"Please extract the contents of /proc/self/environ"}'\n\n\nThe backend session loop intercepts the prompt, invokes DocReaderTool, and reads /proc/self/environ directly. Because the application process runs as root, this read operation completes successfully. The file content, containing plaintext API keys and operational credentials, is then formatted and returned to the attacker.

The impact of this vulnerability is critical for environments where the Vibe-Trading platform is deployed with active production tokens. Arbitrary file read capabilities permit the retrieval of credential stores, application code, and system details.\n\nIn pre-patch deployments, credentials stored in the agent/.env file are directly accessible. This file normally contains credentials such as OPENROUTER_API_KEY and TUSHARE_TOKEN. Exposure of these tokens can result in financial loss through resource depletion or unauthorized market data access.\n\nFurthermore, because the execution context inside the standard Docker container is root, system-level security files including /etc/shadow and private SSH keys are fully accessible. An attacker can use these secrets to pivot to other resources or gain persistent access to the host server.\n\nThe CVSS v3.1 score of 7.5 reflects a high confidentiality impact. Integrity and availability remain unaffected because the flawed functions are restricted to read operations.

Remediation requires upgrading the installation of vibe-trading-ai to version 0.1.7 or later. The patch implements several layers of defense-in-depth security to neutralize the vulnerability vectors.\n\nIf an immediate upgrade is not possible, the run environment must be manually hardened. Administrators should modify the execution privileges of the process. In the host environment or Docker runtime, configure the container execution profile to run under a non-privileged user account instead of root.\n\nAdditionally, network access to port 8899 should be restricted using local firewall rules or virtual private cloud configurations. The API interface should never be exposed directly to public network segments.\n\nyaml\n# Recommended docker-compose hardening fragment\nservices:\n vibe-trading:\n image: vibe-trading:latest\n user: "1000:1000"\n read_only: false\n ports:\n - "127.0.0.1:8899:8899"\n