CVE-2026-19243

Name of the Vulnerable Software and Affected Versions HKUDS nanobot versions prior to 0.3.0

Description An OS command injection flaw exists in the Shell Allowlist Handler component within the nanobot/agent/tools/shell.py file. The issue resides in the ExecTool. guard command() and ExecTool. spawn() functions, where insufficient validation of shell commands containing multiple segments, wrappers, comments, or chained commands allows for remote execution of arbitrary commands.

Recommendations Upgrade to version 0.3.0. As a temporary mitigation, restrict the use of the ExecTool. guard command() and ExecTool. spawn() functions.