Threat Intelligence Database

A vulnerability in HKUDS nanobot up to version 0.2.1 allows remote argument injection via the ExecTool._guard_command and ExecTool._spawn functions in the nanobot/agent/tools/shell.py component. This flaw can be exploited remotely and has a CVSS score of 7.3, indicating a medium severity. A patch identified by commit af582246f141311d574551b7571a517bcc3df750 is available to address this issue. Applying this patch is recommended to mitigate the vulnerability.

A vulnerability exists in HKUDS nanobot up to version 0.2.1 affecting the ExecTool component's functions _guard_command and _spawn in the nanobot/agent/tools/shell.py file. This flaw causes an incomplete blacklist, allowing potential remote attacks. A patch identified by commit af582246f141311d574551b7571a517bcc3df750 is recommended to fix the issue. The vulnerability has a medium severity with a CVSS score of 6.3.

A vulnerability was identified in HKUDS nanobot up to 0.2.1. The affected element is the function ExecTool._guard_command/ExecTool._spawn of the file nanobot/agent/tools/shell.py of the component ExecTool. Such manipulation leads to argument injection. It is possible to launch the attack remotely. The name of the patch is af582246f141311d574551b7571a517bcc3df750. It is best practice to apply a patch to resolve this issue.

A vulnerability was determined in HKUDS nanobot up to 0.2.1. Impacted is the function ExecTool._guard_command/ExecTool._spawn of the file nanobot/agent/tools/shell.py of the component ExecTool. This manipulation causes incomplete blacklist. It is possible to initiate the attack remotely. Patch name: af582246f141311d574551b7571a517bcc3df750. Applying a patch is the recommended action to fix this issue.

A vulnerability has been found in HKUDS nanobot up to 0.2.1. This affects the function _download_image_data_url of the file nanobot/providers/image_generation.py of the component Provider-returned Image URL Handler. The manipulation leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 5095. It is recommended to apply a patch to fix this issue. The vendor explains: "We confirm that provider-returned image URLs required the same SSRF protections applied to other network retrieval paths. (...) The patch is currently available on main and is planned for the next patch release, v0.3.1."

A flaw has been found in HKUDS nanobot up to 0.2.1. The impacted element is the function ExecTool._prepare_command of the file nanobot/agent/tools/shell.py of the component Login-shell Environment Handler. Executing a manipulation can lead to information disclosure. The attack requires local access. The exploit has been published and may be used. Upgrading to version 0.3.0 is sufficient to resolve this issue. This patch is called 4525. The affected component should be upgraded. Multiple issues were reported to the project. They reacted with a high level of professionalism and kindness: "The report concerns shell startup files reintroducing environment variables when command execution defaults to a login shell. The default was changed so exec does not use a login shell unless explicitly requested".

A vulnerability in HKUDS nanobot up to version 0.2.1 allows improper access control due to a flaw in the connect_mcp_servers function. This issue can be exploited remotely and has a public exploit available. The vulnerability is fixed by upgrading to version 0.3.0, which corrects the registration boundary of MCP resource and prompt wrappers to prevent unauthorized access.

A vulnerability was detected in HKUDS nanobot up to 0.2.1. The affected element is the function connect_mcp_servers of the file nanobot/agent/tools/mcp.py of the component MCP enabledTools Scope Handler. Performing a manipulation results in improper access controls. The attack is possible to be carried out remotely. The exploit is now public and may be used. Upgrading to version 0.3.0 is sufficient to fix this issue. The patch is named 4436. You should upgrade the affected component. Multiple issues were reported to the project. They reacted with a high level of professionalism and kindness: "Both reports describe the same root cause: MCP resource and prompt wrappers could be registered outside the intended enabledTools scope. The registration boundary was corrected".

A security vulnerability (CVE-2026-19243) exists in HKUDS nanobot versions up to 0.2.1 in the Shell Allowlist Handler component. The flaw allows remote OS command injection via improper validation of shell commands in the ExecTool._guard_command and ExecTool._spawn functions. The issue is addressed by upgrading to version 0.3.0, which validates each executable shell segment against a configured allowlist. The vulnerability has a CVSS score of 6.3 (medium severity).

A security vulnerability has been detected in HKUDS nanobot up to 0.2.1. Impacted is the function ExecTool._guard_command/ExecTool._spawn of the file nanobot/agent/tools/shell.py of the component Shell Allowlist Handler. Such manipulation leads to os command injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.3.0 is recommended to address this issue. The name of the patch is 4562. It is advisable to upgrade the affected component. Multiple issues were reported to the project. They reacted with a high level of professionalism and kindness: "These five reports are variants of the same root cause: validation of shell commands containing multiple segments, wrappers, comments, or chained commands. The issue was fixed by validating every executable shell segment against the configured allowlist".