EUVD-2026-33757
GHSA-434r-7c99-hwf3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3Blast Radius
ecosystem impact- 1 pypi packages depend on nanobot-ai (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 0.2.1.
DescriptionCVE.org
Nanobot prior to version 0.2.1 contains a server-side request forgery vulnerability in the web_fetch tool that allows remote attackers to reach internal or private network hosts by supplying a URL that redirects to a loopback or private address via a 3xx Location header. Attackers can exploit the automatic HTTP redirect following behavior in the httpx library to bypass initial URL validation and cause the runtime to send outbound requests to internal hosts before final resolved URL validation is applied.
AnalysisAI
Server-side request forgery in Nanobot's web_fetch tool prior to v0.2.1 allows authenticated remote attackers to probe and reach internal or private network hosts by exploiting the httpx library's automatic HTTP redirect-following behavior. The attack bypasses initial URL validation by supplying a legitimate-looking external URL that responds with a 3xx redirect to a loopback or RFC-1918 address - the outbound request to the internal host is dispatched before any post-redirect validation is applied. No public exploit code exists and no CISA KEV listing is present, but the Changed Scope (S:C) in the CVSS vector indicates that successful exploitation can affect network components beyond Nanobot itself, such as internal APIs or metadata services.
Technical ContextAI
Nanobot (CPE: cpe:2.3:a:hkuds:nanobot:*:*:*:*:*:*:*:*) is an AI agent runtime developed by HKUDS that exposes a web_fetch tool enabling the agent to fetch arbitrary URLs on behalf of users. The underlying HTTP client is the Python httpx library, which follows 3xx Location redirects automatically by default. CWE-918 (Server-Side Request Forgery) describes the root cause: the application validates the user-supplied URL before issuing the request but does not re-validate or block the final destination after redirect resolution. This creates a TOCTOU-style gap - the initial URL appears safe (pointing to an attacker-controlled external host), but the 3xx redirect steers httpx to a loopback (127.0.0.1/::1) or private-range address (10.x, 172.16-31.x, 192.168.x) that would normally be rejected. Because the redirect is followed before final URL validation is applied, the request reaches the internal host and any response may be observable by the attacker through the tool's output.
RemediationAI
The primary fix is to upgrade Nanobot to v0.2.1 or later; the patch is available via the GitHub release at https://github.com/HKUDS/nanobot/releases/tag/v0.2.1 and was introduced in commit 545294c62c0947da40eb5b65288aaf02b5fdf632 (PR #3928). If an immediate upgrade is not possible, compensating controls should target the redirect-following behavior: configure the httpx client (or any HTTP client wrapping web_fetch) to disable automatic redirect following, then explicitly validate the Location header URL against an allowlist of permitted external domains before issuing a follow-up request - this eliminates the validation gap without patching. Alternatively, deploy Nanobot behind a network egress filter or HTTP proxy that blocks outbound connections to RFC-1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8, ::1), and cloud metadata service addresses (169.254.169.254) - note this adds operational overhead and may break legitimate internal integrations. Restricting web_fetch tool access to only highly-trusted user roles is a further risk-reduction measure while the patch is being deployed.
Cross-Site WebSocket Hijacking in nanobot personal AI assistant (versions before 0.1.5) allows remote websites to establ
Remote code execution in nanobot personal AI assistant (versions prior to 0.1.6) allows unauthenticated attackers to exe
Arbitrary file write in HKUDS Nanobot's WhatsApp bridge (versions 0.1.5.post3 and prior) allows remote unauthenticated a
Server-side request forgery in Nanobot (HKUDS) prior to 0.2.1 lets unauthenticated remote attackers exfiltrate Microsoft
Argument injection in HKUDS nanobot's ExecTool shell execution guard allows remote unauthenticated attackers to bypass t
OS command injection in HKUDS nanobot 0.2.0 and 0.2.1 allows a low-privileged remote attacker to bypass the configured s
Server-side request forgery in HKUDS nanobot up to 0.2.1 allows authenticated remote attackers to make the server issue
MCP resource and prompt wrappers in HKUDS nanobot 0.2.0 and 0.2.1 bypass operator-defined `enabledTools` access restrict
Login-shell environment variable leakage in HKUDS nanobot up to 0.2.1 exposes sensitive environment variables to local l
Nanobot's Matrix channel media download handler exhausts process memory and bandwidth when authenticated room members su
Shell command injection bypass in HKUDS nanobot 0.2.0-0.2.1 allows authenticated users to evade the ExecTool allow/deny
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today