| Title | HKUDS nanobot 0.2.1 Allowlist Bypass Leading to Command Execution (CWE-184) |
|---|
| Description | # Technical Details
An end-to-end shell allowlist bypass exists in the `ExecTool._guard_command` method in `nanobot/agent/tools/shell.py` of nanobot.
The application fails to evaluate each executable shell segment independently before enforcing `tools.exec.allowPatterns`. A regex matching a safe prefix such as `echo allowlisted` approves the full raw string, and `ExecTool._spawn()` later runs that string with `bash -c`. Through the normal `POST /v1/chat/completions` flow, a payload like `echo allowlisted && touch "canary-created"` is therefore executed end-to-end.
# Vulnerable Code
File: nanobot/agent/tools/shell.py
Method: ExecTool._guard_command() / ExecTool._spawn()
Why: `_guard_command()` treats any whole-string allowlist hit as approval and does not parse shell operators such as `&&`; `_spawn()` then gives the full attacker-controlled command to the shell, which executes the appended segment.
# Reproduction
1. Start `python3 -m nanobot serve` on nanobot 0.2.1 with `tools.exec.allowPatterns` set to a loose rule like `\\becho\\s+allowlisted\\b`, and use the provided fake OpenAI-compatible provider.
2. Send a normal `POST /v1/chat/completions` request that causes the provider to request `exec("echo allowlisted && touch \"canary-created\"")`.
3. Observe HTTP 200, a successful tool result, and creation of the canary file, while a control config using `^echo\\s+allowlisted$` blocks the same payload.
# Impact
- API users who can steer the agent into an `exec` tool call can run extra shell segments beyond the operator’s intended allowlist.
- The nanobot process may be used to modify workspace contents, plant follow-on artifacts, or execute broader host actions where sandboxing is weak. |
|---|
| Source | ⚠️ https://gist.github.com/YLChen-007/4dc0ffff5a8f5e7180503f5a8c409544 |
|---|
| User | Eric-c (UID 96848) |
|---|
| Submission | 06/22/2026 04:27 (2 months ago) |
|---|
| Moderation | 08/07/2026 14:07 (2 months later) |
|---|
| Status | Duplicate |
|---|
| VulDB entry | 386997 [HKUDS nanobot up to 0.2.1 Shell Allowlist shell.py ExecTool._guard_command/ExecTool._spawn os command injection] |
|---|
| Points | 0 |
|---|