Executive brief
HKUDS nanobot is a lightweight AI agent framework with built-in shell execution capabilities. A flaw in the command allowlist filtering lets authenticated users bypass security restrictions and execute unintended shell commands, potentially allowing attackers to perform unauthorized actions on the host system where the agent is running.
Technical details
The vulnerability exists in the ExecTool._guard_command and ExecTool._spawn functions within nanobot/agent/tools/shell.py. The allowlist-based command filtering has an incomplete blacklist that can be bypassed through shell chaining techniques, allowing an attacker to execute arbitrary commands outside the restricted set. The attack is network-reachable and likely requires authentication or local access to the nanobot framework. An attacker can achieve remote code execution on the host system. A patch (commit af582246f141311d574551b7571a517bcc3df750) is available and recommended.
Affected products
- HKUDS nanobot up to 0.2.1
Timeline
- 2026-09-14: disclosed
- 2026-09-14: patched: Patch commit af582246f141311d574551b7571a517bcc3df750