CVE-2026-90809

Deferred Deferred - Pending Action

Argument Injection in HKUDS Nanobot

Publication date: 2026-09-14

Last updated on: 2026-09-15

Assigner: VulDB

Description

A vulnerability was identified in HKUDS nanobot up to 0.2.1. The affected element is the function ExecTool._guard_command/ExecTool._spawn of the file nanobot/agent/tools/shell.py of the component ExecTool. Such manipulation leads to argument injection. It is possible to launch the attack remotely. The name of the patch is af582246f141311d574551b7571a517bcc3df750. It is best practice to apply a patch to resolve this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-15

Generated

2026-10-05

AI Q&A

2026-09-14

EPSS Evaluated

2026-10-03

NVD

CVE-2026-90809

EUVD

EUVD-2026-77759

Affected Vendors & Products

Vendor	Product	Version / Range
hkuds	nanobot	to 0.2.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-88	The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.
CWE-74	The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability is an argument injection flaw in HKUDS nanobot up to version 0.2.1. It exists in the ExecTool._guard_command or ExecTool._spawn function within the nanobot/agent/tools/shell.py file. An attacker can remotely manipulate inputs to inject malicious arguments into system commands.

Detection Guidance

To detect this vulnerability, check if your nanobot version is 0.2.1 or earlier. Run: pip show nanobot. If installed, verify the patched version by checking the commit hash against af582246f141311d574551b7571a517bcc3df750. Inspect shell.py for the fix in ExecTool._guard_command and _spawn functions.

Impact Analysis

This vulnerability allows remote attackers to execute arbitrary commands on the affected system. This could lead to unauthorized access, data theft, system compromise, or disruption of services. The impact depends on the privileges of the nanobot process and system configuration.

Compliance Impact

This vulnerability could lead to unauthorized command execution, potentially allowing attackers to access, modify, or delete sensitive data. For GDPR, this may result in unauthorized data processing or breaches. For HIPAA, it could enable unauthorized access to protected health information. Compliance violations may occur if the system processes regulated data without proper safeguards.

Mitigation Strategies

Apply the patch identified as af582246f141311d574551b7571a517bcc3df750 to the HKUDS nanobot component up to version 0.2.1 to resolve the argument injection vulnerability in ExecTool._guard_command/ExecTool._spawn.

Hi! I’m here to help you understand CVE-2026-90809. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70