提出 #922850: HKUDS nanobot <= 0.2.1 Improper Neutralization of Argument Delimiters in a Command (CWE-88)

# Technical Details
An `exec.allowPatterns` shell-chain bypass exists in the `ExecTool._guard_command()` and `ExecTool._spawn()` methods in `nanobot/agent/tools/shell.py` of nanobot (pip package `nanobot`).

The application fails to neutralize shell argument delimiters before execution: `_guard_command()` lowercases the full user-controlled shell string and marks it as explicitly allowed when any configured allow-pattern matches anywhere in the raw string (explicitly_allowed = bool(self.allow_patterns) and any(re.search(p, lower) for p in self.allow_patterns), shell.py#L563-L586), and `_spawn()` later executes the entire raw string via `bash -c` (`args.extend(["-c", command])`, shell.py#L440-L474). An attacker can append an extra shell segment such as `&& touch /workspace/canary-created` after an allowlisted prefix and get the appended segment executed inside the nanobot process context. Verified end-to-end through the public OpenAI-compatible HTTP API (`POST /v1/chat/completions`) with two live `nanobot serve` instances: a vulnerable instance with `allowPatterns: ["\\becho\\s+allowlisted\\b"]` created the canary file (Exit code 0, session result `allowlisted`), while a control instance with `allowPatterns: ["^echo\\s+allowlisted$"]` rejected the same payload with `Error: Command blocked by allowlist filter (not in allowlist)`.

# Vulnerable Code
File: nanobot/agent/tools/shell.py
Method: ExecTool._guard_command() / ExecTool._spawn() (lines 440-474, 563-586)
Why: `_guard_command()` approves the whole raw shell string when any configured allow-pattern matches somewhere in it, which lets a chained payload inherit allowlist approval from its first segment; `_spawn()` then executes the exact same raw string with `bash -c`, so shell metacharacters such as `&&` are parsed and the extra appended command segment runs after the allowlisted prefix.

# Reproduction
1. Run a nanobot deployment with `tools.exec.enable = true` and `tools.exec.allowPatterns` set to a loose prefix/substring regex, e.g. `["\\becho\\s+allowlisted\\b"]`.
2. Download the orchestration script `run_e2e.py` (https://gist.github.com/YLChen-007/f5ec905ff95a50025bf22dde3cdd2144), the fake provider `fake_provider.py` (https://gist.github.com/YLChen-007/0543f4ddb9188af792c74cc8244dc00b), the vulnerable config `vuln-config.json` (https://gist.github.com/YLChen-007/d000e4060c2b05613d0dc24a747652a4), the control config (https://gist.github.com/YLChen-007/15ef06324886a89bb2da30b14475959d) and the verifiers, then run `python3 run_e2e.py` from the repository root.
3. The script starts a fake provider and two `nanobot serve` processes (vulnerable on 127.0.0.1:18901, control on 127.0.0.1:18902) and drives a normal chat request that produces an exec tool call for `echo allowlisted && touch "<canary-path>"`.
4. Confirm the vulnerable workspace contains `runtime/vuln-workspace/canary-created` and the run logs `[DEFECT-CONFIRMED]` with `vuln_canary_exists: true`.
5. Confirm the control service does not create its canary and instead records `Error: Command blocked by allowlist filter (not in allowlist)` in its session log (`control_canary_exists: false`).

# Impact
- Command-execution policy bypass in the shell tool boundary allowing a caller who can cause an exec tool call to smuggle additional shell segments past an operator-defined allowlist.
- Unintended command execution with the same OS-level privileges as the running nanobot process.
- Can modify files in the agent workspace, delete data, plant follow-on scripts, or chain into broader host compromise if the process is not isolated by a real sandbox.
- Severity High, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H.

• ソース: ⚠️ https://github.com/HKUDS/nanobot/issues/5306
• ユーザー: Eric-a (UID 96353)
• 送信: 2026年08月11日 15:01 (1 月 ago)
• モデレーション: 2026年09月13日 18:11 (1 month later)
• ステータス: 承諾済み
• VulDBエントリ: 403311 [HKUDS nanobot 迄 0.2.1 ExecTool shell.py ExecTool._guard_command/ExecTool._spawn 特権昇格]
• ポイント: 20