CVE-2026-58171
MEDIUM
NVD
CVSS Score
4.2
Severity
MEDIUM
Published
Jun 30, 2026
Vendor
unknown
Description
Vibe-Trading before 0.1.10 constructs the swarm run directory by joining a caller-supplied run identifier onto the runs base directory without validation in run_dir (agent/src/swarm/store.py). A crafted run identifier supplied through the MCP swarm tools causes the application to read arbitrary run.json files outside the runs directory and to overwrite existing run.json files at traversed locations.