attp (0.1.0a0), nanobot-channel-anon (0.1.11) +2 more potentially affected by CVE-2026-92576 via nanobot-ai (>=0.1.4.post4, <=0.2.2)

nanobot-ai PYPI version =0.1.4.post4, =0.1.0, =0.3.0 - runagent-superbrowser 0.1.0 Source cves: CVE-2026-92576 Source advisory: MEND:CVE-2026-92576...

attp (0.1.0a0), nanobot-channel-anon (0.1.11) +2 more potentially affected by CVE-2026-90809 via nanobot-ai (>=0.1.4.post4, <=0.2.2)

nanobot-ai PYPI version =0.1.4.post4, =0.1.0, =0.3.0 - runagent-superbrowser 0.1.0 Source cves: CVE-2026-90809 Source advisory: MEND:CVE-2026-90809...

attp (0.1.0a0), nanobot-channel-anon (0.1.11) +2 more potentially affected by CVE-2026-90808 via nanobot-ai (>=0.1.4.post4, <=0.2.2)

nanobot-ai PYPI version =0.1.4.post4, =0.1.0, =0.3.0 - runagent-superbrowser 0.1.0 Source cves: CVE-2026-90808 Source advisory: MEND:CVE-2026-90808...

attp (0.1.0a0), nanobot-channel-anon (0.1.11) +2 more potentially affected by CVE-2026-19245 via nanobot-ai (>=0.1.4.post4, <=0.2.2)

nanobot-ai PYPI version =0.1.4.post4, =0.1.0, =0.3.0 - runagent-superbrowser 0.1.0 Source cves: CVE-2026-19245 Source advisory: MEND:CVE-2026-19245...

attp (0.1.0a0), nanobot-channel-anon (0.1.11) +2 more potentially affected by CVE-2026-19244 via nanobot-ai (>=0.1.4.post4, <=0.2.2)

nanobot-ai PYPI version =0.1.4.post4, =0.1.0, =0.3.0 - runagent-superbrowser 0.1.0 Source cves: CVE-2026-19244 Source advisory: MEND:CVE-2026-19244...

attp (0.1.0a0), nanobot-webui (>=0.1.0, <=0.2.9) +1 more potentially affected by CVE-2026-49138 via nanobot-ai (>=0.1.4.post4, <=0.1.5.post3)

nanobot-ai PYPI version =0.1.4.post4, =0.1.0, =0.2.9 - runagent-superbrowser 0.1.0 Source cves: CVE-2026-49138 Source advisory: OSV:PYSEC-2026-3580...

attp (0.1.0a0), nanobot-webui (>=0.1.0, <=0.2.9) +1 more potentially affected by CVE-2026-49138 via nanobot-ai (>=0.1.4.post4, <=0.1.5.post3)

nanobot-ai PYPI version =0.1.4.post4, =0.1.0, =0.2.9 - runagent-superbrowser 0.1.0 Source cves: CVE-2026-49138 Source advisory: GHSA-434R-7C99-HWF3...

Server-side Request Forgery (SSRF)

Overview nanobot-ai is an A lightweight personal AI assistant framework Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the webfetch process. An attacker can access internal or private network resources by supplying a crafted URL that triggers an HTTP...

attp (0.1.0a0), nanobot-webui (>=0.1.0, <=0.2.9) +1 more potentially affected by CVE-2026-49138 via nanobot-ai (>=0.1.4.post4, <=0.1.5.post3)

nanobot-ai PYPI version =0.1.4.post4, =0.1.0, =0.2.9 - runagent-superbrowser 0.1.0 Source cves: CVE-2026-49138 Source advisory: OSV:GHSA-434R-7C99-HWF3...

attp (0.1.0a0), nanobot-webui (>=0.1.0, <=0.2.9) +1 more potentially affected by CVE-2026-49138 via nanobot-ai (>=0.1.4.post4, <=0.1.5.post3)

nanobot-ai PYPI version =0.1.4.post4, =0.1.0, =0.2.9 - runagent-superbrowser 0.1.0 Source cves: CVE-2026-49138 Source advisory: SNYK:PYTHON-NANOBOTAI-18507996...

attp (0.1.0a0), nanobot-webui (>=0.1.0, <=0.2.9) +1 more potentially affected by CVE-2026-49140 via nanobot-ai (>=0.1.4.post4, <=0.1.5.post3)

nanobot-ai PYPI version =0.1.4.post4, =0.1.0, =0.2.9 - runagent-superbrowser 0.1.0 Source cves: CVE-2026-49140 Source advisory: MEND:CVE-2026-49140...

attp (0.1.0a0), nanobot-webui (>=0.1.0, <=0.2.9) +1 more potentially affected by CVE-2026-49139 via nanobot-ai (>=0.1.4.post4, <=0.1.5.post3)

nanobot-ai PYPI version =0.1.4.post4, =0.1.0, =0.2.9 - runagent-superbrowser 0.1.0 Source cves: CVE-2026-49139 Source advisory: MEND:CVE-2026-49139...

attp (0.1.0a0), nanobot-webui (>=0.1.0, <=0.2.9) +1 more potentially affected by CVE-2026-49138 via nanobot-ai (>=0.1.4.post4, <=0.1.5.post3)

nanobot-ai PYPI version =0.1.4.post4, =0.1.0, =0.2.9 - runagent-superbrowser 0.1.0 Source cves: CVE-2026-49138 Source advisory: MEND:CVE-2026-49138...

nanobot-webui (>=0.1.0, <=0.2.6) potentially affected by CVE-2026-35589 via nanobot-ai (>=0.1.4.post4, <=0.1.4.post6)

nanobot-ai PYPI version =0.1.4.post4, =0.1.0, =0.2.6 Source cves: CVE-2026-35589 Source advisory: MEND:CVE-2026-35589...

Nanobot security vulnerabilities

Nanobot is a lightweight personal AI assistant open-source by Data Intelligence Lab@HKU. Versions of Nanobot prior to 0.1.5 contained a security vulnerability; this vulnerability stemmed from the WebSocket server not verifying the Origin header, which could lead to cross-site WebSocket hijacking...