HKUDS nanobot vulnerabilities
4 known CVE vulnerabilities in HKUDS nanobot, translated and rated.
- CVE-2026-19246Medium
A vulnerability was found in HKUDS nanobot up to 0.2.1 in the _download_image_data_url function of nanobot/providers/image_generation.py, leading to server-side request forgery (SSRF). The attack can be initiated remotely and the exploit is public. Applying a patch is recommended.
- CVE-2026-19245Low
A vulnerability in HKUDS nanobot up to 0.2.1 affects the ExecTool._prepare_command function in nanobot/agent/tools/shell.py of the Login-shell Environment Handler component. Executing a manipulation can lead to information disclosure. The attack requires local access, and the exploit has been published.
- CVE-2026-19244Medium
A vulnerability was detected in HKUDS nanobot up to 0.2.1 in the connect_mcp_servers function of nanobot/agent/tools/mcp.py, leading to improper access controls. The attack can be performed remotely and the exploit is public. Upgrading to version 0.3.0 fixes the issue.
- CVE-2026-19243Medium
A vulnerability was detected in HKUDS nanobot up to 0.2.1 in the ExecTool._guard_command/ExecTool._spawn functions of nanobot/agent/tools/shell.py, leading to OS command injection. The attack can be executed remotely and the exploit is public. Upgrading to version 0.3.0 is recommended.