PT-2026-69125

CVE-2026-19243

Published

2026-08-07

Updated

2026-10-23

Description by

CVSS 2.0

6.5

Medium

MetricsAV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions HKUDS nanobot versions prior to 0.3.0

Description An OS command injection flaw exists in the Shell Allowlist Handler component within the nanobot/agent/tools/shell.py file. The issue resides in the ExecTool. guard command() and ExecTool. spawn() functions, where insufficient validation of shell commands containing multiple segments, wrappers, comments, or chained commands allows for remote execution of arbitrary commands.

Recommendations Upgrade to version 0.3.0. As a temporary mitigation, restrict the use of the ExecTool. guard command() and ExecTool. spawn() functions.

Exploitability

Exploit

Fix

Impacts

Researchers

Eric-C

Vendors

Affected products

Weakness enumeration

CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')

CWE-77: Improper Neutralization of Special Elements used in a Command (\'Command Injection\')

Related identifiers