HKUDS nanobot up to 0.2.1 Shell Allowlist shell.py ExecTool._guard_command/ExecTool._spawn os command injection

Summaryinfo

A vulnerability identified as critical has been detected in HKUDS nanobot up to 0.2.1. The affected element is the function ExecTool._guard_command/ExecTool._spawn of the file nanobot/agent/tools/shell.py of the component Shell Allowlist Handler. Performing a manipulation results in os command injection. This vulnerability is reported as CVE-2026-19243. The attack is possible to be carried out remotely. Moreover, an exploit is present. You should upgrade the affected component. Multiple issues were reported to the project. They reacted with a high level of professionalism and kindness: "These five reports are variants of the same root cause: validation of shell commands containing multiple segments, wrappers, comments, or chained commands. The issue was fixed by validating every executable shell segment against the configured allowlist".

Detailsinfo

A vulnerability was found in HKUDS nanobot up to 0.2.1. It has been classified as critical. This affects the function ExecTool._guard_command/ExecTool._spawn of the file nanobot/agent/tools/shell.py of the component Shell Allowlist Handler. The manipulation with an unknown input leads to a os command injection vulnerability. CWE is classifying the issue as CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-19243. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details and a public exploit are known. MITRE ATT&CK project uses the attack technique T1202 for this issue.

The exploit is shared for download at gist.github.com. It is declared as proof-of-concept. Multiple issues were reported to the project. They reacted with a high level of professionalism and kindness: "These five reports are variants of the same root cause: validation of shell commands containing multiple segments, wrappers, comments, or chained commands. The issue was fixed by validating every executable shell segment against the configured allowlist".

Upgrading to version 0.3.0 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 4562 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• HKUDS

Name

• nanobot

Version

• 0.2.0
• 0.2.1

Website

• Product: https://github.com/HKUDS/nanobot/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #865112: HKUDS nanobot 0.2.1 OS Command Injection via Allowlist Bypass (CWE-78) (by Eric-c)

Duplicate

• Submit #XXXXXX: Xxxxx Xxxxxxx X.x.x Xxxxxxx Xxxxxxxxx Xxx Xxxxxxx-xxxx Xxxxxxxxx Xxxxxx (xxx-xx) (by Eric-c)
• Submit #XXXXXX: Xxxxx Xxxxxxx X.x.x Xxxxxxxxx Xxxxxx Xxx Xxxxxxx Xxxxxx (xxx-xxx) (by Eric-c)
• Submit #XXXXXX: Xxxxx Xxxxxxx X.x.x Xxxxxxxxx Xxxxxx Xxxxxxx Xx Xxxxxxx Xxxxxxxxx (xxx-xxx) (by Eric-c)
• Submit #XXXXXX: Xxxxx Xxxxxxx X.x.x Xxxxxxx Xxxxxxxxx Xxx Xxxxx-xxxxx Xxxxxxxxx Xxxxxx (xxx-xx) (by Eric-c)

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion