Hkuds Nanobot
13 CVEs affecting Hkuds Nanobot. Latest disclosed: 2026-09-14. Critical: 2, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-2577 | Critical | 10.0 | 2026-02-16 | The WhatsApp bridge component in Nanobot binds the WebSocket server to all network interfaces (0.0.0.0) on port 3001 by default and does not require authentica… |
CVE-2026-33654 | Critical | 9.8 | 2026-03-27 | nanobot is a personal AI assistant. Prior to version 0.1.6, an indirect prompt injection vulnerability exists in the email channel processing module (`nanobot/… |
CVE-2026-48716 | High | 8.7 | 2026-06-18 | nanobot is a personal AI assistant. In versions 0.1.5.post3 and prior, the WhatsApp bridge in bridge/src/whatsapp.ts constructs a filesystem path using the fil… |
CVE-2026-35589 | High | 8.0 | 2026-04-14 | nanobot is a personal AI assistant. Versions prior to 0.1.5 contain a Cross-Site WebSocket Hijacking (CSWSH) vulnerability exists in the bridge's WebSocket ser… |
CVE-2026-90809 | High | 7.3 | 2026-09-14 | A vulnerability was identified in HKUDS nanobot up to 0.2.1. The affected element is the function ExecTool._guard_command/ExecTool._spawn of the file nanobot/a… |
CVE-2026-90808 | Medium | 6.3 | 2026-09-14 | A vulnerability was determined in HKUDS nanobot up to 0.2.1. Impacted is the function ExecTool._guard_command/ExecTool._spawn of the file nanobot/agent/tools/s… |
CVE-2026-19246 | Medium | 6.3 | 2026-08-07 | A vulnerability has been found in HKUDS nanobot up to 0.2.1. This affects the function _download_image_data_url of the file nanobot/providers/image_generation… |
CVE-2026-19243 | Medium | 6.3 | 2026-08-07 | A security vulnerability has been detected in HKUDS nanobot up to 0.2.1. Impacted is the function ExecTool._guard_command/ExecTool._spawn of the file nanobot/a… |
CVE-2026-49138 | Medium | 5.0 | 2026-06-01 | Nanobot prior to version 0.2.1 contains a server-side request forgery vulnerability in the web_fetch tool that allows remote attackers to reach internal or pri… |
CVE-2026-19244 | Medium | 4.7 | 2026-08-07 | A vulnerability was detected in HKUDS nanobot up to 0.2.1. The affected element is the function connect_mcp_servers of the file nanobot/agent/tools/mcp.py of t… |
CVE-2026-49140 | Medium | 4.3 | 2026-06-01 | Nanobot prior to version 0.2.1 contains a denial of service vulnerability in the Matrix channel media download handler that allows authenticated room members t… |
CVE-2026-19245 | Low | 3.3 | 2026-08-07 | A flaw has been found in HKUDS nanobot up to 0.2.1. The impacted element is the function ExecTool._prepare_command of the file nanobot/agent/tools/shell.py of… |
CVE-2026-49139 | | 2026-06-01 | Nanobot prior to version 0.2.1 contains a server-side request forgery vulnerability in the Microsoft Teams channel handler that allows remote attackers to exfi… |