137 matches found
EUVD-2026-81276
HKUDS nanobot before 0.3.0 contains a server-side request forgery vulnerability in the WebFetchTool component where the validateurl function fails to block internal IP ranges and private addresses. Attackers can send messages instructing the bot to fetch cloud metadata endpoints, localhost...
CVE-2026-92576
HKUDS nanobot before 0.3.0 contains a server-side request forgery vulnerability in the WebFetchTool component where the validateurl function fails to block internal IP ranges and private addresses. Attackers can send messages instructing the bot to fetch cloud metadata endpoints, localhost...
CVE-2026-92576 HKUDS nanobot before 0.3.0 Server-Side Request Forgery via WebFetchTool
HKUDS nanobot before 0.3.0 contains a server-side request forgery vulnerability in the WebFetchTool component where the validateurl function fails to block internal IP ranges and private addresses. Attackers can send messages instructing the bot to fetch cloud metadata endpoints, localhost...
attp (0.1.0a0), nanobot-channel-anon (0.1.11) +2 more potentially affected by CVE-2026-92576 via nanobot-ai (>=0.1.4.post4, <=0.2.2)
nanobot-ai PYPI version =0.1.4.post4, =0.1.0, =0.3.0 - runagent-superbrowser 0.1.0 Source cves: CVE-2026-92576 Source advisory: MEND:CVE-2026-92576...
CVE-2026-92576
HKUDS nanobot before version 0.3.0 is affected by a server-side request forgery (SSRF) vulnerability in the WebFetchTool component. The root cause is the _validate_url() function failing to block internal IP ranges and private addresses, allowing attackers to send messages instructing the bot to ...
CVE-2026-92576 HKUDS nanobot before 0.3.0 Server-Side Request Forgery via WebFetchTool
HKUDS nanobot before 0.3.0 contains a server-side request forgery vulnerability in the WebFetchTool component where the validateurl function fails to block internal IP ranges and private addresses. Attackers can send messages instructing the bot to fetch cloud metadata endpoints, localhost...
CVE-2026-92576 HKUDS nanobot before 0.3.0 Server-Side Request Forgery via WebFetchTool
HKUDS nanobot before 0.3.0 contains a server-side request forgery vulnerability in the WebFetchTool component where the validateurl function fails to block internal IP ranges and private addresses. Attackers can send messages instructing the bot to fetch cloud metadata endpoints, localhost...
CVE-2026-92576: Server-Side Request Forgery (SSRF)
HKUDS nanobot before 0.3.0 contains a server-side request forgery vulnerability in the WebFetchTool component where the validateurl function fails to block internal IP ranges and private addresses. Attackers can send messages instructing the bot to fetch cloud metadata endpoints, localhost...
PT-2026-94093
Name of the Vulnerable Software and Affected Versions HKUDS nanobot versions prior to 0.3.0 Description The WebFetchTool component contains a server-side request forgery SSRF issue, where the validate url function fails to block private addresses and internal IP ranges. This allows attackers to...
CVE-2026-90809
A vulnerability was identified in HKUDS nanobot up to 0.2.1. The affected element is the function ExecTool.guardcommand/ExecTool.spawn of the file nanobot/agent/tools/shell.py of the component ExecTool. Such manipulation leads to argument injection. It is possible to launch the attack remotely. T...
CVE-2026-90808
A vulnerability was determined in HKUDS nanobot up to 0.2.1. Impacted is the function ExecTool.guardcommand/ExecTool.spawn of the file nanobot/agent/tools/shell.py of the component ExecTool. This manipulation causes incomplete blacklist. It is possible to initiate the attack remotely. Patch name:...
EUVD-2026-77759
A vulnerability was identified in HKUDS nanobot up to 0.2.1. The affected element is the function ExecTool.guardcommand/ExecTool.spawn of the file nanobot/agent/tools/shell.py of the component ExecTool. Such manipulation leads to argument injection. It is possible to launch the attack remotely. T...
CVE-2026-90809 HKUDS nanobot ExecTool shell.py ExecTool._spawn argument injection
A vulnerability was identified in HKUDS nanobot up to 0.2.1. The affected element is the function ExecTool.guardcommand/ExecTool.spawn of the file nanobot/agent/tools/shell.py of the component ExecTool. Such manipulation leads to argument injection. It is possible to launch the attack remotely. T...
CVE-2026-90809
HKUDS nanobot (versions up to 0.2.1) is affected by an argument injection vulnerability in the ExecTool component, specifically in the ExecTool._guard_command and ExecTool._spawn functions within nanobot/agent/tools/shell.py. The flaw allows a remote attacker with no privileges or user interactio...
CVE-2026-90809 HKUDS nanobot ExecTool shell.py ExecTool._spawn argument injection
A vulnerability was identified in HKUDS nanobot up to 0.2.1. The affected element is the function ExecTool.guardcommand/ExecTool.spawn of the file nanobot/agent/tools/shell.py of the component ExecTool. Such manipulation leads to argument injection. It is possible to launch the attack remotely. T...
CVE-2026-90809 HKUDS nanobot ExecTool shell.py ExecTool._spawn argument injection
A vulnerability was identified in HKUDS nanobot up to 0.2.1. The affected element is the function ExecTool.guardcommand/ExecTool.spawn of the file nanobot/agent/tools/shell.py of the component ExecTool. Such manipulation leads to argument injection. It is possible to launch the attack remotely. T...
attp (0.1.0a0), nanobot-channel-anon (0.1.11) +2 more potentially affected by CVE-2026-90809 via nanobot-ai (>=0.1.4.post4, <=0.2.2)
nanobot-ai PYPI version =0.1.4.post4, =0.1.0, =0.3.0 - runagent-superbrowser 0.1.0 Source cves: CVE-2026-90809 Source advisory: MEND:CVE-2026-90809...
EUVD-2026-77768
A vulnerability was determined in HKUDS nanobot up to 0.2.1. Impacted is the function ExecTool.guardcommand/ExecTool.spawn of the file nanobot/agent/tools/shell.py of the component ExecTool. This manipulation causes incomplete blacklist. It is possible to initiate the attack remotely. Patch name:...
CVE-2026-90808 HKUDS nanobot ExecTool shell.py ExecTool._spawn incomplete blacklist
A vulnerability was determined in HKUDS nanobot up to 0.2.1. Impacted is the function ExecTool.guardcommand/ExecTool.spawn of the file nanobot/agent/tools/shell.py of the component ExecTool. This manipulation causes incomplete blacklist. It is possible to initiate the attack remotely. Patch name:...
CVE-2026-90808 HKUDS nanobot ExecTool shell.py ExecTool._spawn incomplete blacklist
A vulnerability was determined in HKUDS nanobot up to 0.2.1. Impacted is the function ExecTool.guardcommand/ExecTool.spawn of the file nanobot/agent/tools/shell.py of the component ExecTool. This manipulation causes incomplete blacklist. It is possible to initiate the attack remotely. Patch name:...