PT-2026-91404

CVE-2026-90809

Published

2026-09-14

Updated

2026-09-15

Description by

CVSS 2.0

7.5

High

MetricsAV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions HKUDS nanobot versions prior to 0.2.2

Description An argument injection flaw exists in the ExecTool component, specifically within the ExecTool. guard command() and ExecTool. spawn() functions located in the nanobot/agent/tools/shell.py file. This issue allows a remote attacker to inject arguments into commands executed by the system.

Recommendations Apply patch af582246f141311d574551b7571a517bcc3df750 to resolve the issue. As a temporary mitigation, restrict the use of the ExecTool. guard command() and ExecTool. spawn() functions.

Exploitability

Exploit

Fix

Impacts

Researchers

Eric-A

Vendors

Affected products

Weakness enumeration

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\'Injection\')

CWE-88: Improper Neutralization of Argument Delimiters in a Command (\'Argument Injection\')

Related identifiers