EUVD-2026-54680
GHSA-g4fw-p4hw-gq39
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
GET-only image download path limits impact to partial confidentiality via SSRF; PR:L reflects required authenticated access; no direct integrity or availability impact from this specific function.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability has been found in HKUDS nanobot up to 0.2.1. This affects the function _download_image_data_url of the file nanobot/providers/image_generation.py of the component Provider-returned Image URL Handler. The manipulation leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 5095. It is recommended to apply a patch to fix this issue. The vendor explains: "We confirm that provider-returned image URLs required the same SSRF protections applied to other network retrieval paths. (...) The patch is currently available on main and is planned for the next patch release, v0.3.1."
AnalysisAI
Server-side request forgery in HKUDS nanobot up to 0.2.1 allows authenticated remote attackers to make the server issue HTTP requests to arbitrary internal endpoints by manipulating URLs returned by AI image generation providers. The _download_image_data_url function in nanobot/providers/image_generation.py fetched provider-returned image URLs directly via client.get(url) without routing through the existing validate_url_target SSRF guard in security/network.py, leaving cloud metadata endpoints (e.g., 169.254.169.254), RFC1918 ranges, and internal services reachable. A public POC exploit exists; a patch is available on the main branch as PR #5095 and is planned for release in v0.3.1. No CISA KEV listing; exploitation is not confirmed at mass scale.
Technical ContextAI
nanobot is an open-source AI agent framework from HKUDS (Hong Kong University of Data Science) that orchestrates LLM-backed agents with tool use, including AI image generation via external providers. The affected CPE is cpe:2.3:a:hkuds:nanobot:*:*:*:*:*:*:*:*. CWE-918 (Server-Side Request Forgery) manifests because the _download_image_data_url function unconditionally fetched HTTP URLs returned by provider APIs without applying the shared validate_url_target or resolve_url_target guards defined in security/network.py. Those guards block loopback, RFC1918 private ranges, CGNAT (100.64.0.0/10), link-local (169.254.0.0/16), and cloud metadata endpoints. The PR #5095 fix introduces PinnedDNSAsyncTransport for DNS-pinned direct downloads, adds per-redirect URL revalidation with resolve_url_target, enforces a 32 MiB response size cap, and supports an explicit user-configured proxy with its own trust boundary semantics for providers whose image hostnames are DNS-unavailable to the nanobot host.
RemediationAI
Apply the upstream patch from PR #5095 (https://github.com/HKUDS/nanobot/pull/5095), which is currently merged into the main branch and planned for release as v0.3.1. Until a tagged release is published, operators can install nanobot directly from the patched main branch commit. As a compensating network-layer control prior to patching, configure egress firewall rules on the nanobot host to block outbound HTTP/HTTPS to RFC1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), CGNAT (100.64.0.0/10), link-local (169.254.0.0/16), and cloud metadata IPs (notably 169.254.169.254) - this replicates the in-code SSRF guard at the network layer. Note that network-layer controls are weaker than the code-level fix because they cannot protect against DNS rebinding attacks; the patched PinnedDNSAsyncTransport resolves DNS once and pins the connection, preventing rebinding. Additionally, restrict nanobot instance access to trusted authenticated users only, as PR:L is a prerequisite for exploitation.
Cross-Site WebSocket Hijacking in nanobot personal AI assistant (versions before 0.1.5) allows remote websites to establ
Remote code execution in nanobot personal AI assistant (versions prior to 0.1.6) allows unauthenticated attackers to exe
Arbitrary file write in HKUDS Nanobot's WhatsApp bridge (versions 0.1.5.post3 and prior) allows remote unauthenticated a
Server-side request forgery in Nanobot (HKUDS) prior to 0.2.1 lets unauthenticated remote attackers exfiltrate Microsoft
Argument injection in HKUDS nanobot's ExecTool shell execution guard allows remote unauthenticated attackers to bypass t
OS command injection in HKUDS nanobot 0.2.0 and 0.2.1 allows a low-privileged remote attacker to bypass the configured s
MCP resource and prompt wrappers in HKUDS nanobot 0.2.0 and 0.2.1 bypass operator-defined `enabledTools` access restrict
Login-shell environment variable leakage in HKUDS nanobot up to 0.2.1 exposes sensitive environment variables to local l
Nanobot's Matrix channel media download handler exhausts process memory and bandwidth when authenticated room members su
Server-side request forgery in Nanobot's web_fetch tool prior to v0.2.1 allows authenticated remote attackers to probe a
Shell command injection bypass in HKUDS nanobot 0.2.0-0.2.1 allows authenticated users to evade the ExecTool allow/deny
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today