CVE-2026-35589
HighCVSS 8.0Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
nanobot, a personal AI assistant, prior to version 0.1.5 contains a Cross-Site WebSocket Hijacking (CSWSH) vulnerability in the bridge's WebSocket server. The server does not validate the Origin header during the WebSocket handshake, and token authentication is disabled by default. Any website visited by a user running the bridge can establish a WebSocket connection and gain full access to the bridge API, allowing hijacking of the WhatsApp session, reading messages, stealing authentication QR codes, and sending messages on behalf of the user.
Risk Assessment
An attacker can hijack the user's WhatsApp session, gaining access to private messages and the ability to send messages on their behalf, posing a serious privacy and security breach.
Recommendation
Immediately update nanobot to version 0.1.5 or later, which contains the fix.
Other vulnerabilities in nanobot
See all- CVE-2026-49140Medium
Nanobot prior to version 0.2.1 has a denial of service vulnerability in the Matrix channel media download handler. Authenticated room members can exhaust process memory and bandwidth by sending media events with missing or invalid size metadata.
- CVE-2026-49139High
SSRF vulnerability in Nanobot prior to version 0.2.1 in the Microsoft Teams channel handler. A remote attacker can forge an activity with a controlled serviceUrl value, leading to exfiltration of Bot Framework bearer tokens.
- CVE-2026-49138Medium
Nanobot prior to version 0.2.1 contains a server-side request forgery vulnerability in the web_fetch tool, allowing attackers to reach internal hosts via URL redirection to loopback or private addresses, exploiting automatic HTTP redirect following.
Original NVD description (English source)
nanobot is a personal AI assistant. Versions prior to 0.1.5 contain a Cross-Site WebSocket Hijacking (CSWSH) vulnerability exists in the bridge's WebSocket server in bridge/src/server.ts, resulting from an incomplete remediation of CVE-2026-2577. The original fix changed the binding from 0.0.0.0 to 127.0.0.1 and added an optional BRIDGE_TOKEN parameter, but token authentication is disabled by default and the server does not validate the Origin header during the WebSocket handshake. Because browsers do not enforce the Same-Origin Policy on WebSockets unless the server explicitly denies cross-origin connections, any website visited by a user running the bridge can establish a WebSocket connection to ws://127.0.0.1:3001/ and gain full access to the bridge API. This allows an attacker to hijack the WhatsApp session, read incoming messages, steal authentication QR codes, and send messages on behalf of the user. This issue has bee fixed in version 0.1.5.