提出 #865112: HKUDS nanobot 0.2.1 OS Command Injection via Allowlist Bypass (CWE-78)

# Technical Details
A shell allowlist bypass exists in the `ExecTool._guard_command` method in `nanobot/agent/tools/shell.py` of nanobot.

The application fails to validate the effective shell command after policy matching. It only checks whether an allowlisted regex such as `^echo\b` appears in the full raw command string, then later executes that same full string through `bash -c` in `ExecTool._spawn()`. As a result, a payload like `echo SAFE; touch allowlist_bypass_canary.txt` passes validation and executes the chained command.

# Vulnerable Code
File: nanobot/agent/tools/shell.py
Method: ExecTool._guard_command() / ExecTool._spawn()
Why: `_guard_command()` uses `re.search()` on the full attacker-controlled string and treats any allowlist hit as approval, while `_spawn()` forwards the same raw string to the shell with `-c`, allowing metacharacters such as `;` to execute arbitrary appended commands.

# Reproduction
1. Enable the `exec` tool on nanobot 0.2.1 with `allowPatterns` containing a benign prefix rule such as `^echo\b`.
2. Trigger an `exec` call with `echo SAFE; touch allowlist_bypass_canary.txt` through an authenticated chat/API/tool-calling path or the provided PoC.
3. Observe that nanobot accepts the payload and creates the canary file, proving the chained command executed.

# Impact
- An attacker who can influence `exec` tool calls can execute arbitrary shell commands with the privileges of the nanobot process.
- Workspace files, local secrets, and follow-on shell actions can be abused despite the operator-configured allowlist.

• ソース: ⚠️ https://gist.github.com/YLChen-007/8fcbf8e49e7be568e1a92e9e0414fdba
• ユーザー: Eric-c (UID 96848)
• 送信: 2026年06月22日 04:15 (2 月 ago)
• モデレーション: 2026年08月07日 14:07 (2 months later)
• ステータス: 承諾済み
• VulDBエントリ: 386997 [HKUDS nanobot 迄 0.2.1 Shell Allowlist shell.py ExecTool._guard_command/ExecTool._spawn 特権昇格]
• ポイント: 20