Executive brief
HKUDS nanobot is an open-source Python framework for building AI agents with shell command execution capabilities. A vulnerability in the ExecTool component allows attackers to inject arbitrary arguments into shell commands, potentially bypassing security restrictions and executing unintended commands remotely. This could enable attackers to gain unauthorized system access or execute malicious operations through the agent framework.
Technical details
An argument injection vulnerability exists in the ExecTool._guard_command and ExecTool._spawn functions within nanobot/agent/tools/shell.py. The vulnerability allows attackers to craft malicious input that bypasses the exec.allowPatterns security filter, enabling shell-chain attacks that execute unintended commands. The attack is network-accessible and does not require authentication. An attacker can exploit this to execute arbitrary shell commands with the privileges of the nanobot process. A fix is available in patch af582246f141311d574551b7571a517bcc3df750 and should be applied to versions 0.2.1 and earlier.
Affected products
- HKUDS nanobot up to 0.2.1
Timeline
- 2026-09-14: disclosed
- 2026-09-14: patched: Patch af582246f141311d574551b7571a517bcc3df750