EUVD-2026-77768
GHSA-vwc9-2889-5p3f
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authentication required (PR:L); scope changes to host system via shell injection (S:C); all three impacts apply at low severity given typical agent sandboxing.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in HKUDS nanobot up to 0.2.1. Impacted is the function ExecTool._guard_command/ExecTool._spawn of the file nanobot/agent/tools/shell.py of the component ExecTool. This manipulation causes incomplete blacklist. It is possible to initiate the attack remotely. Patch name: af582246f141311d574551b7571a517bcc3df750. Applying a patch is the recommended action to fix this issue.
AnalysisAI
Shell command injection bypass in HKUDS nanobot 0.2.0-0.2.1 allows authenticated users to evade the ExecTool allow/deny pattern filter by embedding newline or carriage-return characters in command strings. The _split_shell_segments() function in shell.py treated only ; and | as command delimiters, so a payload on a subsequent line (e.g., echo allowlisted\nrm -rf /tmp/sensitive) passes the filter entirely unchecked. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated nanobot user (PR:L per CVSS 4.0) with access to the ExecTool interface. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.3 (Medium) with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L is internally consistent with a network-reachable, low-complexity attack requiring authentication - the SSVC confirms automatable is 'no,' suggesting the attacker must know or guess a valid allow_pattern prefix, which adds contextual friction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply upstream patch commit af582246f141311d574551b7571a517bcc3df750, available at https://github.com/HKUDS/nanobot/commit/af582246f141311d574551b7571a517bcc3df750 and the associated PR at https://github.com/HKUDS/nanobot/pull/5345. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Cross-Site WebSocket Hijacking in nanobot personal AI assistant (versions before 0.1.5) allows remote websites to establ
Remote code execution in nanobot personal AI assistant (versions prior to 0.1.6) allows unauthenticated attackers to exe
Arbitrary file write in HKUDS Nanobot's WhatsApp bridge (versions 0.1.5.post3 and prior) allows remote unauthenticated a
Server-side request forgery in Nanobot (HKUDS) prior to 0.2.1 lets unauthenticated remote attackers exfiltrate Microsoft
Argument injection in HKUDS nanobot's ExecTool shell execution guard allows remote unauthenticated attackers to bypass t
OS command injection in HKUDS nanobot 0.2.0 and 0.2.1 allows a low-privileged remote attacker to bypass the configured s
Server-side request forgery in HKUDS nanobot up to 0.2.1 allows authenticated remote attackers to make the server issue
MCP resource and prompt wrappers in HKUDS nanobot 0.2.0 and 0.2.1 bypass operator-defined `enabledTools` access restrict
Login-shell environment variable leakage in HKUDS nanobot up to 0.2.1 exposes sensitive environment variables to local l
Nanobot's Matrix channel media download handler exhausts process memory and bandwidth when authenticated room members su
Server-side request forgery in Nanobot's web_fetch tool prior to v0.2.1 allows authenticated remote attackers to probe a
Same weakness CWE-184 – Incomplete List of Disallowed Inputs
View allShare
External POC / Exploit Code
Leaving vuln.today