| Title | HKUDS nanobot 0.2.1 Command Injection via Shell-Chain Allowlist Bypass (CWE-88) |
|---|
| Description | # Technical Details
A shell-chain allowlist bypass exists in the `ExecTool._guard_command` method in `nanobot/agent/tools/shell.py` of nanobot.
The application fails to enforce `tools.exec.allowPatterns` on the full effective shell behavior. It lowercases the raw command string, approves it if a loose pattern like `\\becho\\s+allowlisted\\b` matches anywhere, and then executes the same string with `bash -c`. A payload such as `echo allowlisted && touch /workspace/canary-created` therefore inherits approval from its first segment and still executes the appended command.
# Vulnerable Code
File: nanobot/agent/tools/shell.py
Method: ExecTool._guard_command() / ExecTool._spawn()
Why: The allowlist logic is substring-based and shell-unaware, while the execution path is shell-aware. That check/execute mismatch lets `&&` or other shell separators smuggle unauthorized commands past the policy boundary.
# Reproduction
1. Run the provided end-to-end lab for nanobot 0.2.1 with a vulnerable config using `allowPatterns: ["\\becho\\s+allowlisted\\b"]` and a fake provider that triggers the `exec` tool.
2. Send the command `echo allowlisted && touch "<canary-path>"` through the real OpenAI-compatible service flow.
3. Observe that the vulnerable workspace contains `canary-created`, while the control instance using `^echo\\s+allowlisted$` records an allowlist error and does not create its canary.
# Impact
- An attacker who can induce an `exec` tool call can execute unintended shell commands under the nanobot process account.
- Files in the agent workspace can be created, modified, or deleted, enabling follow-on tampering or broader compromise where stronger isolation is absent. |
|---|
| Source | ⚠️ https://gist.github.com/YLChen-007/da7ee2c191ffbfa46ccd12ee66f5bf85 |
|---|
| User | Eric-c (UID 96848) |
|---|
| Submission | 06/22/2026 04:28 (2 months ago) |
|---|
| Moderation | 08/07/2026 14:07 (2 months later) |
|---|
| Status | Duplicate |
|---|
| VulDB entry | 386997 [HKUDS nanobot up to 0.2.1 Shell Allowlist shell.py ExecTool._guard_command/ExecTool._spawn os command injection] |
|---|
| Points | 0 |
|---|