HKUDS nanobot

• CVE-2026-92576 High 8.6 HKUDS nanobot before 0.3.0 Server-Side Request Forgery via WebFetchTool 0.4%
• CVE-2026-90809 High 7.3 HKUDS nanobot ExecTool shell.py ExecTool._spawn argument injection 0.6%
• CVE-2026-90808 Medium 6.3 HKUDS nanobot ExecTool shell.py ExecTool._spawn incomplete blacklist 0.4%
• CVE-2026-19246 Medium 6.3 HKUDS nanobot Provider-returned Image URL image_generation.py _download_image_data_url server-side request forgery 0.4%
• CVE-2026-19245 Low 3.3 HKUDS nanobot Login-shell Environment shell.py ExecTool._prepare_command information disclosure 0.2%
• CVE-2026-19244 Medium 4.7 HKUDS nanobot MCP enabledTools Scope mcp.py connect_mcp_servers access control 0.5%
• CVE-2026-19243 Medium 6.3 HKUDS nanobot Shell Allowlist shell.py ExecTool._spawn os command injection 2.3%
• CVE-2026-48716 High 8.7 nanobot: Path traversal via unsanitized WhatsApp document fileName enables arbitrary file write 0.3%
• CVE-2026-49140 Medium 4.3 Nanobot < 0.2.1 Denial of Service via Matrix Media Download Handler 0.3%
• CVE-2026-49139 High 7.0 Nanobot < 0.2.1 SSRF via Microsoft Teams Channel serviceUrl Poisoning 0.4%
• CVE-2026-49138 Medium 5.0 Nanobot < 0.2.1 SSRF via web_fetch Tool Redirect Following 0.4%
• CVE-2026-35589 High 8.0 nanobot: Cross-Site WebSocket Hijacking in WhatsApp Bridge (CVE-2026-2577 Fix Update) 0.2%
• CVE-2026-33654 High 8.9 Zero-Click Indirect Prompt Injection and Authentication Bypass via Email Polling 0.5%
• CVE-2026-2577 Critical 10.0 Nanobot Unauthenticated WhatsApp Session Hijack via WebSocket Bridge 0.7%