Skip to contentHkuds Nanobot vulnerabilities
- hkuds nanobotHKUDS nanobot before 0.3.0 Server-Side Request Forgery via WebFetchToolCVE-2026-925769.2 Critical
- hkuds nanobotHKUDS nanobot ExecTool shell.py ExecTool._spawn argument injectionCVE-2026-908096.9 Medium
- hkuds nanobotHKUDS nanobot ExecTool shell.py ExecTool._spawn incomplete blacklistCVE-2026-908085.3 Medium
- hkuds nanobotHKUDS nanobot Provider-returned Image URL image_generation.py _download_image_data_url server-side request forgeryCVE-2026-192465.3 Medium
- hkuds nanobotHKUDS nanobot Login-shell Environment shell.py ExecTool._prepare_command information disclosureCVE-2026-192454.8 Medium
- hkuds nanobotHKUDS nanobot MCP enabledTools Scope mcp.py connect_mcp_servers access controlCVE-2026-192445.1 Medium
- hkuds nanobotHKUDS nanobot Shell Allowlist shell.py ExecTool._spawn os command injectionCVE-2026-192435.3 Medium
- hkuds nanobotnanobot: Path traversal via unsanitized WhatsApp document fileName enables arbitrary file writeCVE-2026-487168.7 High
- hkuds nanobotNanobot < 0.2.1 Denial of Service via Matrix Media Download HandlerCVE-2026-491405.3 Medium
- hkuds nanobotNanobot < 0.2.1 SSRF via Microsoft Teams Channel serviceUrl PoisoningCVE-2026-491397.0 High
- hkuds nanobotNanobot < 0.2.1 SSRF via web_fetch Tool Redirect FollowingCVE-2026-49138Fix available5.3 Medium
- hkuds nanobotnanobot: Cross-Site WebSocket Hijacking in WhatsApp Bridge (CVE-2026-2577 Fix Update)CVE-2026-355898.0 High
- hkuds nanobotZero-Click Indirect Prompt Injection and Authentication Bypass via Email PollingCVE-2026-336548.9 High
- hkuds nanobotNanobot Unauthenticated WhatsApp Session Hijack via WebSocket BridgeCVE-2026-257710.0 Critical