nanobot CVE-2026-19245

Exploitation requires (1) local non-remote access to the system where nanobot is installed, and (2) low-privilege authenticated access sufficient to invoke ExecTool.execute() or the nanobot shell execution API - anonymous or network-only attackers cannot exploit this. Under default configuration of nanobot up to 0.2.1, the vulnerability triggers automatically on any shell command execution without additional setup, because login=True is the hardcoded default. Exploitation is materially limited by: the mandatory local access requirement (AV:L) ruling out all remote attack paths; the low-privilege authentication requirement (PR:L) meaning at minimum a valid local account or equivalent API access is needed; and the impact boundary being restricted to environment variables surfaced by login-shell startup scripts - no arbitrary file read, code execution, or integrity impact is implied. The vulnerability is only meaningful if startup scripts on the target system export sensitive values (credentials, tokens) into the shell environment, which is common in developer workstations and CI environments but less universal in hardened production deployments.

The CVSS 4.0 base score of 1.9 with vector AV:L/AC:L/AT:N/PR:L/UI:N/VC:L accurately reflects the limited real-world risk of this vulnerability. Local access is mandatory (AV:L), which immediately eliminates remote exploitation scenarios. Low-privilege access is required (PR:L), meaning anonymous or network-only actors cannot exploit this. The confidentiality impact is bounded at Low (VC:L) - environment variable leakage rather than arbitrary file read or full credential extraction. EPSS data was not provided in the available intelligence sources, so exploitation probability cannot be quantified beyond the CVSS signal. No CISA KEV listing confirms this has not been observed in active exploitation campaigns. A publicly available POC exists on GitHub Gist, which elevates the feasibility of exploitation modestly for those who already meet the local access prerequisite. Overall, this is a genuine but low-priority vulnerability; risk is elevated only in shared multi-user environments where nanobot executes commands on behalf of users with differing privilege levels, or in containerized environments where startup-file-injected secrets might cross trust boundaries.

A low-privilege local user on a system running nanobot up to 0.2.1 invokes shell commands through the agent framework's ExecTool.execute() API. Because _prepare_command defaults to login-shell mode, bash sources the system-wide /etc/profile and user-level ~/.bash_profile, which re-export environment variables - for example, OPENAI_API_KEY or database connection strings set by a higher-privilege service account. The attacker reads these variables from the shell environment of the spawned process, obtaining credentials without requiring elevated access. A publicly available proof-of-concept on GitHub Gist (https://gist.github.com/YLChen-007/b25f3f185478e0b2cd0e727bf5c5ed9b) demonstrates this behavior.