| Title | HKUDS nanobot 0.2.1 Command Injection via Comment-Tail Allowlist Bypass (CWE-88) |
|---|
| Description | # Technical Details
A comment-tail allowlist bypass exists in the `ExecTool._guard_command` method in `nanobot/agent/tools/shell.py` of nanobot.
The application fails to account for POSIX shell comment semantics when enforcing `exec.allow_patterns`. It approves the raw command string if an allowlisted token appears anywhere, including after `#`, and then executes the same string through the shell. A payload like `touch "/path/to/comment-tail-canary" # echo allowlisted` therefore passes the regex guard while the shell ignores the comment tail and executes only the malicious pre-comment payload.
# Vulnerable Code
File: nanobot/agent/tools/shell.py
Method: ExecTool._guard_command() / ExecTool._spawn()
Why: `_guard_command()` matches `allow_patterns` against the entire raw string with `re.search()`, but `_spawn()` later invokes `bash -c`, where the `# ...` suffix is discarded as a comment and the attacker-controlled `touch` command still runs.
# Reproduction
1. Enable `ExecTool` on nanobot 0.2.1 with `allow_patterns=[r"\becho\s+allowlisted\b"]` and `restrict_to_workspace=True`.
2. Trigger the command `touch "<canary>" # echo allowlisted` through the real `ToolRegistry` or provided PoC.
3. Observe that the command is accepted and the canary file is created, while a plain `touch "<canary>"` control case is blocked.
# Impact
- An attacker can execute unintended shell commands while making the raw command text appear to satisfy the operator allowlist.
- Workspace files, scripts, and sensitive material can be modified or harvested from the nanobot runtime context. |
|---|
| Source | ⚠️ https://gist.github.com/YLChen-007/f491f368cabe21a832ee3da29437de18 |
|---|
| User | Eric-c (UID 96848) |
|---|
| Submission | 06/22/2026 04:17 (2 months ago) |
|---|
| Moderation | 08/07/2026 14:07 (2 months later) |
|---|
| Status | Duplicate |
|---|
| VulDB entry | 386997 [HKUDS nanobot up to 0.2.1 Shell Allowlist shell.py ExecTool._guard_command/ExecTool._spawn os command injection] |
|---|
| Points | 0 |
|---|