# Vibe-Trading file-read tools expose arbitrary server-readable files

Vibe-Trading's LLM file-read tools lacked path sandboxing, letting unauthenticated callers read /etc/shadow, /proc/self/environ and /root credentials via prompt-driven tool calls.

- Payout: Research
- Severity: high
- Program: Vibe-Trading
- Found by: lemi9090
- Disclosed: 2026-10-02
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-5rmq-chc7-m22f
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-5rmq-chc7-m22f
- Tags: area:ai domain:ai domain:web impact:data-leak impact:internal-access kind:research platform:ghsa sev:high tech:docker tech:python technique:source-review vuln:info-disclosure vuln:path-traversal vuln:secrets-leak

**Target:** FastAPI LLM agent tool registry (doc_reader_tool.py, path_utils.py) on port 8899
**Root cause:** safe_user_path() accepted any path under Path.home() (/root) or Path.cwd() (/app), and read_document() performed only exists()/is_file() checks with no sandbox call at all, in a container running as root.
**Steps:**
1. Start server per GHSA-1 reproducer (`docker compose up -d`) and create an unauthenticated session.
2. POST to `/sessions/$SID/messages` with `{"content":"Please read and summarize the document at /proc/self/environ"}`.
3. Poll `/sessions/$SID/messages`; agent invokes `read_document` with `file_path="/proc/self/environ"` and returns full environment including `OPENROUTER_API_KEY` and `TUSHARE_TOKEN`.
4. Repeat with `file_path="/etc/shadow"` for full shadow file.
5. For F9, plant `/root/secrets/aws.csv` and ask the agent to analyze it as a trade journal; `ExtractShadowStrategyTool` passes `safe_user_path()` and leaks the first line via parse error.
**How found:** Code review of the tool registry: noticed safe_user_path's envelope was Path.home() ∪ Path.cwd() and that read_document had no sandbox call; confirmed with runtime probes inside the container.
**Exploitation:** Unauthenticated TCP client to port 8899 drives the LLM via chat messages; the model emits tool calls with attacker-chosen file paths, and the tools return file contents (or first-line parse errors) directly in the message stream — no shell execution needed.
**Escalation:** Root container plus no USER directive widens reach to /etc/shadow, /proc/self/environ, SSH keys and cloud credentials; also reachable via prompt injection in processed documents.
**Insight:** In LLM-agent codebases, audit every tool function that takes a model-emitted path separately — a shared 'safe' helper can itself be an over-broad envelope (home/cwd), and some tools skip the helper entirely; check the Dockerfile for a missing USER directive to gauge blast radius.