EUVD-2026-54617
GHSA-m259-67hc-p7v5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable API requires low-privilege authentication; limited C/I/A and unchanged scope reflect partial OS command impact confined to the vulnerable nanobot host.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A security vulnerability has been detected in HKUDS nanobot up to 0.2.1. Impacted is the function ExecTool._guard_command/ExecTool._spawn of the file nanobot/agent/tools/shell.py of the component Shell Allowlist Handler. Such manipulation leads to os command injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.3.0 is recommended to address this issue. The name of the patch is 4562. It is advisable to upgrade the affected component. Multiple issues were reported to the project. They reacted with a high level of professionalism and kindness: "These five reports are variants of the same root cause: validation of shell commands containing multiple segments, wrappers, comments, or chained commands. The issue was fixed by validating every executable shell segment against the configured allowlist".
AnalysisAI
OS command injection in HKUDS nanobot 0.2.0 and 0.2.1 allows a low-privileged remote attacker to bypass the configured shell command allowlist by submitting chained shell commands using operators such as &&, ||, ;, |, or &. The ExecTool._guard_command method in shell.py validated the entire raw command string as a single unit against allow patterns, meaning only the first chained segment needed to match - subsequent malicious segments executed unchecked. A public proof-of-concept exploit exists; the vulnerability is not listed in CISA KEV but the CVSS 4.0 E:P modifier confirms publicly available exploit code elevates urgency beyond the base score of 5.3.
Technical ContextAI
nanobot is an AI agent orchestration framework by HKUDS that exposes a shell execution capability via ExecTool, governed by a configurable allow_patterns list intended to restrict which OS commands agents may invoke. The vulnerable logic in _guard_command applied re.fullmatch against allow patterns to the full raw command string rather than parsing it into discrete shell segments first. Because shell interpreters process chaining operators (&&, ||, ;, |, &) as command delimiters, an attacker could prepend an allowlisted command followed by a malicious one - the regex would match the allowlisted prefix and pass the full string to execution. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) is the precise root cause class: user-controlled input reaches a shell interpreter without complete sanitization of all logical command units. CPE cpe:2.3:a:hkuds:nanobot:*:*:*:*:*:*:*:* covers affected versions through 0.2.1. The fix in PR #4562 introduces _split_shell_segments, a stateful parser that correctly handles quoted strings, parentheses, and escape sequences to split commands at top-level chain operators, then requires all resulting segments to individually match a configured allow pattern.
RemediationAI
Upgrade nanobot to version 0.3.0, confirmed available at https://github.com/HKUDS/nanobot/releases/tag/v0.3.0. The patch in PR #4562 resolves the root cause by introducing a _split_shell_segments parser that tokenizes commands at top-level chain operators (&&, ||, ;, |, &) while correctly handling quoted strings and parenthesized subshells, then requires every parsed segment to match a configured allow pattern via all(any(...)) rather than the previous any() against the raw string. If immediate upgrade is not feasible, restrict invocation of the ExecTool shell capability to fully-trusted internal callers only by tightening API authentication and authorization controls - note this does not fix the underlying bypass but reduces exposure surface. Alternatively, disable the shell tool entirely in agent configurations where it is not operationally required; nanobot supports selective tool enablement. Narrowing allow patterns to commands with no meaningful prefix (i.e., patterns that cannot realistically precede a chain operator in a valid use case) may reduce exploitability but is not a reliable fix given the multiple bypass variants reported.
Cross-Site WebSocket Hijacking in nanobot personal AI assistant (versions before 0.1.5) allows remote websites to establ
Remote code execution in nanobot personal AI assistant (versions prior to 0.1.6) allows unauthenticated attackers to exe
Arbitrary file write in HKUDS Nanobot's WhatsApp bridge (versions 0.1.5.post3 and prior) allows remote unauthenticated a
Server-side request forgery in Nanobot (HKUDS) prior to 0.2.1 lets unauthenticated remote attackers exfiltrate Microsoft
Argument injection in HKUDS nanobot's ExecTool shell execution guard allows remote unauthenticated attackers to bypass t
Server-side request forgery in HKUDS nanobot up to 0.2.1 allows authenticated remote attackers to make the server issue
MCP resource and prompt wrappers in HKUDS nanobot 0.2.0 and 0.2.1 bypass operator-defined `enabledTools` access restrict
Login-shell environment variable leakage in HKUDS nanobot up to 0.2.1 exposes sensitive environment variables to local l
Nanobot's Matrix channel media download handler exhausts process memory and bandwidth when authenticated room members su
Server-side request forgery in Nanobot's web_fetch tool prior to v0.2.1 allows authenticated remote attackers to probe a
Shell command injection bypass in HKUDS nanobot 0.2.0-0.2.1 allows authenticated users to evade the ExecTool allow/deny
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today