Skip to main content

nanobot EUVDEUVD-2026-77768

| CVE-2026-90808 MEDIUM
Incomplete List of Disallowed Inputs (CWE-184)
2026-09-14 VulDB GHSA-vwc9-2889-5p3f
Nanobot
5.3
CVSS 4.0 · Vendor: VulDB
Share

Severity by source

Vendor (VulDB) PRIMARY
5.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.4 HIGH

Authentication required (PR:L); scope changes to host system via shell injection (S:C); all three impacts apply at low severity given typical agent sandboxing.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Metadata Corrected
Sep 15, 2026 - 08:40 vuln.today
tag: Information Disclosure removed
Source Code Evidence Fetched
Sep 15, 2026 - 08:11 vuln.today
Analysis Generated
Sep 15, 2026 - 08:11 vuln.today

DescriptionCVE.org

A vulnerability was determined in HKUDS nanobot up to 0.2.1. Impacted is the function ExecTool._guard_command/ExecTool._spawn of the file nanobot/agent/tools/shell.py of the component ExecTool. This manipulation causes incomplete blacklist. It is possible to initiate the attack remotely. Patch name: af582246f141311d574551b7571a517bcc3df750. Applying a patch is the recommended action to fix this issue.

AnalysisAI

Shell command injection bypass in HKUDS nanobot 0.2.0-0.2.1 allows authenticated users to evade the ExecTool allow/deny pattern filter by embedding newline or carriage-return characters in command strings. The _split_shell_segments() function in shell.py treated only ; and | as command delimiters, so a payload on a subsequent line (e.g., echo allowlisted\nrm -rf /tmp/sensitive) passes the filter entirely unchecked. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires an authenticated nanobot user (PR:L per CVSS 4.0) with access to the ExecTool interface. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 5.3 (Medium) with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L is internally consistent with a network-reachable, low-complexity attack requiring authentication - the SSVC confirms automatable is 'no,' suggesting the attacker must know or guess a valid allow_pattern prefix, which adds contextual friction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Apply upstream patch commit af582246f141311d574551b7571a517bcc3df750, available at https://github.com/HKUDS/nanobot/commit/af582246f141311d574551b7571a517bcc3df750 and the associated PR at https://github.com/HKUDS/nanobot/pull/5345. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Nanobot

View all
CVE-2026-35589 CRITICAL
9.3 Apr 14

Cross-Site WebSocket Hijacking in nanobot personal AI assistant (versions before 0.1.5) allows remote websites to establ
CVE-2026-33654 HIGH
8.9 Mar 27

Remote code execution in nanobot personal AI assistant (versions prior to 0.1.6) allows unauthenticated attackers to exe
CVE-2026-48716 HIGH
8.7 Jun 18

Arbitrary file write in HKUDS Nanobot's WhatsApp bridge (versions 0.1.5.post3 and prior) allows remote unauthenticated a
CVE-2026-49139 HIGH
7.0 Jun 01

Server-side request forgery in Nanobot (HKUDS) prior to 0.2.1 lets unauthenticated remote attackers exfiltrate Microsoft
CVE-2026-90809 MEDIUM
6.9 Sep 14

Argument injection in HKUDS nanobot's ExecTool shell execution guard allows remote unauthenticated attackers to bypass t
CVE-2026-19243 LOW POC
2.1 Aug 07

OS command injection in HKUDS nanobot 0.2.0 and 0.2.1 allows a low-privileged remote attacker to bypass the configured s
CVE-2026-19246 LOW POC
2.1 Aug 07

Server-side request forgery in HKUDS nanobot up to 0.2.1 allows authenticated remote attackers to make the server issue

CVE-2026-19244 LOW POC
2.0 Aug 07

MCP resource and prompt wrappers in HKUDS nanobot 0.2.0 and 0.2.1 bypass operator-defined `enabledTools` access restrict
CVE-2026-19245 LOW POC
1.9 Aug 07

Login-shell environment variable leakage in HKUDS nanobot up to 0.2.1 exposes sensitive environment variables to local l
CVE-2026-49140 MEDIUM
5.3 Jun 01

Nanobot's Matrix channel media download handler exhausts process memory and bandwidth when authenticated room members su
CVE-2026-49138 MEDIUM
5.3 Jun 01

Server-side request forgery in Nanobot's web_fetch tool prior to v0.2.1 allows authenticated remote attackers to probe a

Same weakness CWE-184 – Incomplete List of Disallowed Inputs

View all
CVE-2026-34415 CRITICAL POC
9.3
CVE-2026-41264 CRITICAL POC
9.2
CVE-2026-70470 CRITICAL POC
9.5
CVE-2024-5217 CRITICAL POC
9.2
CVE-2023-2017 HIGH POC
8.8
CVE-2023-29003 HIGH POC
8.8
CVE-2021-25631 HIGH POC
8.8
CVE-2018-6383 HIGH POC
8.8

Share

EUVD-2026-77768 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy