إرسال #865114: HKUDS nanobot 0.2.1 Command Injection via Comment-Tail Allowlist Bypass (CWE-88)

# Technical Details
A comment-tail allowlist bypass exists in the `ExecTool._guard_command` method in `nanobot/agent/tools/shell.py` of nanobot.

The application fails to account for POSIX shell comment semantics when enforcing `exec.allow_patterns`. It approves the raw command string if an allowlisted token appears anywhere, including after `#`, and then executes the same string through the shell. A payload like `touch "/path/to/comment-tail-canary" # echo allowlisted` therefore passes the regex guard while the shell ignores the comment tail and executes only the malicious pre-comment payload.

# Vulnerable Code
File: nanobot/agent/tools/shell.py
Method: ExecTool._guard_command() / ExecTool._spawn()
Why: `_guard_command()` matches `allow_patterns` against the entire raw string with `re.search()`, but `_spawn()` later invokes `bash -c`, where the `# ...` suffix is discarded as a comment and the attacker-controlled `touch` command still runs.

# Reproduction
1. Enable `ExecTool` on nanobot 0.2.1 with `allow_patterns=[r"\becho\s+allowlisted\b"]` and `restrict_to_workspace=True`.
2. Trigger the command `touch "<canary>" # echo allowlisted` through the real `ToolRegistry` or provided PoC.
3. Observe that the command is accepted and the canary file is created, while a plain `touch "<canary>"` control case is blocked.

# Impact
- An attacker can execute unintended shell commands while making the raw command text appear to satisfy the operator allowlist.
- Workspace files, scripts, and sensitive material can be modified or harvested from the nanobot runtime context.

• المصدر: ⚠️ https://gist.github.com/YLChen-007/f491f368cabe21a832ee3da29437de18
• المستخدم: Eric-c (UID 96848)
• ارسال: 22/06/2026 04:17 AM (2 أشهر منذ)
• الاعتدال: 07/08/2026 02:07 PM (2 months later)
• الحالة: مكرر
• إدخال VulDB: 386997 [HKUDS nanobot حتى 0.2.1 Shell Allowlist shell.py ExecTool._guard_command/ExecTool._spawn تجاوز الصلاحيات]
• النقاط: 0