Data Intelligence Lab@HKU Vibe-Trading prompt injection vulnerability

In Data Intelligence Lab@HKU Vibe-Trading versions 0.1.0 through 0.1.7, there is a prompt injection vulnerability. This occurs because the agent injects commands into documents or web pages; BashTool and BackgroundRunTool pass the commands generated by the model directly to subprocess.run execute...

Data Intelligence Lab@HKU Vibe-Trading path traversal vulnerability

Data Intelligence Lab@HKU Vibe-Trading versions 0.1.0 through 0.1.7 contain a path traversal vulnerability. This flaw stems from improper handling of paths in the LLM agent file reading tool; readdocument lacks proper sandbox checks, and the safeuserpath restriction can be bypassed. As a result,...

Data Intelligence Lab@HKU Vibe-Trading authorization issue vulnerability

In Data Intelligence Lab@HKU Vibe-Trading versions 0.1.0 through 0.1.7, there is an authorization issue vulnerability. This arises because when APIAUTHKEY is not set, requireauth returns early, allowing unauthenticated attackers to access the FastAPI interface. They can post messages via...

Nanobot code issues and vulnerabilities

Nanobot is a lightweight personal AI assistant open-source by Data Intelligence Lab@HKU. Versions of Nanobot prior to 0.2.1 contained code vulnerabilities. These vulnerabilities stemmed from issues with server-side request forgeing in the webFetch tool. This could allow remote attackers to access...

OpenHarness security vulnerabilities

OpenHarness is a lightweight development and runtime framework for Data Intelligence Lab@HKU, open source in nature. There is a security vulnerability in OpenHarness; this vulnerability stems from incomplete path normalization in the permission checker, which may lead to access to sensitive files...

Nanobot security vulnerabilities

Nanobot is a lightweight personal AI assistant open-source by Data Intelligence Lab@HKU. Versions of Nanobot prior to 0.1.5 contained a security vulnerability; this vulnerability stemmed from the WebSocket server not verifying the Origin header, which could lead to cross-site WebSocket hijacking...

Nanobot security vulnerabilities

Nanobot is a lightweight personal AI assistant open-source by Data Intelligence Lab@HKU. Versions of Nanobot prior to 0.1.6 contained a security vulnerability. This vulnerability stemmed from an indirect prompt injection issue in the email channel processing module, which could allow remote...