What is the CVSS score of CVE-2026-48716?

CVE-2026-48716 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Nanobot are affected by CVE-2026-48716?

HKUDS Nanobot's WhatsApp bridge (versions 0.1.5.post3 and prior) exposes organizations to code execution attacks via message attachments, enabling attackers to compromise system integrity and access…

How to fix or mitigate CVE-2026-48716?

Within 24 hours: Execute asset inventory query for HKUDS Nanobot deployments; identify running versions and business function dependencies. Within 7 days: Apply network access controls to isolate WhatsApp bridge processes; implement strict validation rules on document fileName parameters to reject path traversal patterns (e.g., ../ sequences). Within 30 days: Subscribe to HKUDS security advisories; upgrade to version 0.1.5.post4 upon vendor release.

Nanobot CVE-2026-48716

EUVD-2026-37933 HIGH

Path Traversal (CWE-22)

2026-06-18 GitHub_M

Path Traversal Node.js Nanobot Hkuds

8.7

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.7 HIGH

AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H

vuln.today AI

8.9 HIGH

Network-reachable WhatsApp bridge with no auth (AV:N/PR:N/UI:N); AC:H because attacker needs bridge enabled and a viable writable target path; scope changes to host filesystem; C:L since written files may be readable, I:H/A:H from write-anywhere.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 18, 2026 - 20:02 vuln.today

CVE Published

Jun 18, 2026 - 18:46 cve.org

HIGH 8.7

DescriptionCVE.org

nanobot is a personal AI assistant. In versions 0.1.5.post3 and prior, the WhatsApp bridge in bridge/src/whatsapp.ts constructs a filesystem path using the fileName field from an incoming WhatsApp document message without sanitization. The WhatsApp bridge downloads media attachments and writes them to disk using a filename derived from the sender's message via documentMessage.fileName, which is concatenated with a prefix and its raw value is passed directly to path.join(mediaDir, outFilename). Node.js path.join resolves .. components, allowing an attacker to escape the intended media/ directory by sending a document with a crafted fileName such as ../../../.ssh/authorized_keys. Because the attacker also controls the file content (the downloaded buffer), this is a write-anywhere primitive - both path and content are attacker-controlled. A fix for this issue is planned for version 0.1.5.post4.

AnalysisAI

Arbitrary file write in HKUDS Nanobot's WhatsApp bridge (versions 0.1.5.post3 and prior) allows remote unauthenticated attackers to write attacker-controlled content to arbitrary filesystem locations by sending a WhatsApp document message with a path-traversal sequence in its fileName field. Because both the destination path and the file content are attacker-controlled, exploitation yields a write-anywhere primitive that can be escalated to remote code execution (e.g., by overwriting authorized_keys or shell startup files). No public exploit identified at time of analysis; a fix is planned for version 0.1.5.post4.

Technical ContextAI

Nanobot is a personal AI assistant by HKUDS that exposes a WhatsApp bridge implemented in TypeScript/Node.js (bridge/src/whatsapp.ts). The bridge receives incoming WhatsApp messages, downloads any attached media via the Baileys-style documentMessage handling, and persists the binary buffer to disk. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory): the code concatenates a prefix with documentMessage.fileName and feeds the unsanitized string into Node.js's path.join(mediaDir, outFilename). Contrary to a common misconception, path.join does NOT clamp the result inside its first argument - it normalizes '..' segments, so a fileName like '../../../.ssh/authorized_keys' resolves outside mediaDir. The CPE cpe:2.3:a:hkuds:nanobot:*:*:* confirms all versions of the hkuds/nanobot application up to and including 0.1.5.post3 are affected.

RemediationAI

No vendor-released patch identified at time of analysis; the vendor states a fix is planned for version 0.1.5.post4, so upgrade to that release as soon as it ships (track https://github.com/HKUDS/nanobot/security/advisories/GHSA-3f63-vcp3-hvqr). Until the patched release is available, disable the WhatsApp bridge entirely if it is not in active use (eliminates the attack surface but breaks WhatsApp integration), or apply a local patch in bridge/src/whatsapp.ts to sanitize documentMessage.fileName before path construction - strip directory separators and '..' segments, then validate that path.resolve(mediaDir, outFilename) still starts with path.resolve(mediaDir) and reject otherwise (low side effects beyond rejecting unusual filenames). As defense in depth, run the Nanobot process as an unprivileged user with no write access to SSH keys, cron directories, or shell rc files, ideally inside a container with a read-only root filesystem and a dedicated writable media volume.