Is CVE-2026-58171 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-58171?

CVE-2026-58171 has a CVSS v3 severity of MEDIUM (4.2).

Back

CVE-2026-58171

Description

Vibe-Trading before 0.1.10 constructs the swarm run directory by joining a caller-supplied run identifier onto the runs base directory without validation in run_dir (agent/src/swarm/store.py). A crafted run identifier supplied through the MCP swarm tools causes the application to read arbitrary run.json files outside the runs directory and to overwrite existing run.json files at traversed locations.