Threats tagged 'ghsa-m259-67hc-p7v5'

A command injection vulnerability exists in HKUDS nanobot versions up to 0.2.1 in the Shell Allowlist Handler component. The flaw affects the ExecTool._guard_command and ExecTool._spawn functions in nanobot/agent/tools/shell.py, allowing remote attackers to execute arbitrary OS commands. The issue arises from insufficient validation of shell commands containing multiple segments or chained commands. The vulnerability has been publicly disclosed with exploit details available. Upgrading to version 0.3.0, which includes validation of every executable shell segment against a configured allowlist, mitigates the issue.