EUVD-2026-54676
GHSA-hfxr-wggc-4cr6
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local access and low privilege are required to invoke nanobot shell execution; impact is limited to confidentiality of environment variables, with no integrity or availability effect.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A flaw has been found in HKUDS nanobot up to 0.2.1. The impacted element is the function ExecTool._prepare_command of the file nanobot/agent/tools/shell.py of the component Login-shell Environment Handler. Executing a manipulation can lead to information disclosure. The attack requires local access. The exploit has been published and may be used. Upgrading to version 0.3.0 is sufficient to resolve this issue. This patch is called 4525. The affected component should be upgraded. Multiple issues were reported to the project. They reacted with a high level of professionalism and kindness: "The report concerns shell startup files reintroducing environment variables when command execution defaults to a login shell. The default was changed so exec does not use a login shell unless explicitly requested".
AnalysisAI
Login-shell environment variable leakage in HKUDS nanobot up to 0.2.1 exposes sensitive environment variables to local low-privilege users during agent-driven shell command execution. The ExecTool._prepare_command function in shell.py defaulted to invoking bash/zsh with the -l (login shell) flag, causing system and user profile startup scripts to be sourced and potentially re-exporting credentials, API keys, or tokens into the execution environment where they could be read by the invoking user. A publicly available proof-of-concept exploit exists; no active exploitation has been confirmed (not listed in CISA KEV). The vendor-released fix in v0.3.0 changes the default from login-shell to non-login-shell execution.
Technical ContextAI
nanobot is an AI agent framework from the HKUDS research group (Hong Kong University of Science and Technology Data Science Lab) that provides shell command execution via the ExecTool class in nanobot/agent/tools/shell.py. The vulnerable _prepare_command function constructed shell invocations with login=True as the default, passing the -l flag to bash/zsh. Login shells source initialization files including /etc/profile, ~/.bash_profile, ~/.profile, and ~/.bashrc (via profile), which frequently set or re-export environment variables. In agent and multi-user contexts, these startup files may expose API keys, database credentials, or session tokens belonging to higher-privilege processes or other users. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) describes this root cause: the framework inadvertently expanded the information available to command invocations beyond what was intended, purely due to a misconfigured default in the shell initialization pathway. The CPE cpe:2.3:a:hkuds:nanobot:*:*:*:*:*:*:*:* covers all affected versions through 0.2.1. The patch diff confirms three locations where login=True was changed to login=False as the default.
RemediationAI
Upgrade nanobot to version 0.3.0 or later, confirmed released by the vendor at https://github.com/HKUDS/nanobot/releases/tag/v0.3.0 via PR #4525 (https://github.com/HKUDS/nanobot/pull/4525). The fix changes the default value of the login parameter from True to False across _prepare_command, _wrap_path_export, and the _PreparedCommand class descriptor, preventing automatic login-shell invocation. Note that any caller in custom integrations explicitly passing login=True will still trigger login-shell behavior and should be audited after upgrading. If immediate upgrade is not feasible, restrict nanobot shell execution access to fully trusted local users only, eliminating the privilege-separation condition that makes the disclosure meaningful. Additionally, audit shell startup files on affected systems to remove or guard any exported secrets - this mitigates impact even without patching, though it introduces maintenance overhead and does not address the root-cause default.
Cross-Site WebSocket Hijacking in nanobot personal AI assistant (versions before 0.1.5) allows remote websites to establ
Remote code execution in nanobot personal AI assistant (versions prior to 0.1.6) allows unauthenticated attackers to exe
Arbitrary file write in HKUDS Nanobot's WhatsApp bridge (versions 0.1.5.post3 and prior) allows remote unauthenticated a
Server-side request forgery in Nanobot (HKUDS) prior to 0.2.1 lets unauthenticated remote attackers exfiltrate Microsoft
OS command injection in HKUDS nanobot 0.2.0 and 0.2.1 allows a low-privileged remote attacker to bypass the configured s
Server-side request forgery in HKUDS nanobot up to 0.2.1 allows authenticated remote attackers to make the server issue
MCP resource and prompt wrappers in HKUDS nanobot 0.2.0 and 0.2.1 bypass operator-defined `enabledTools` access restrict
Nanobot's Matrix channel media download handler exhausts process memory and bandwidth when authenticated room members su
Server-side request forgery in Nanobot's web_fetch tool prior to v0.2.1 allows authenticated remote attackers to probe a
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today