Advisories · Technology
HKUDS nanobot.
Every CVE that names HKUDS nanobot among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 9.2 CriticalCritical · CVSS 9+
HKUDS nanobot before 0.3.0 Server-Side Request Forgery via WebFetchTool
- HKUDS nanobot
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
HKUDS nanobot ExecTool shell.py ExecTool._spawn argument injection
- HKUDS nanobot
- Other injection
- Command injection
- CVSS 5.3 Medium
HKUDS nanobot ExecTool shell.py ExecTool._spawn incomplete blacklist
- HKUDS nanobot
- CWE-183
- CWE-184
- CVSS 5.3 Medium
HKUDS nanobot Provider-returned Image URL image_generation.py _download_image_data_url server-side request forgery
- HKUDS nanobot
- Server-side request forgery (SSRF)
- CVSS 4.8 Medium
HKUDS nanobot Login-shell Environment shell.py ExecTool._prepare_command information disclosure
- HKUDS nanobot
- Information disclosure
- Broken access control
- CVSS 5.1 Medium
HKUDS nanobot MCP enabledTools Scope mcp.py connect_mcp_servers access control
- HKUDS nanobot
- Privilege escalation
- Broken access control
- CVSS 5.3 Medium
HKUDS nanobot Shell Allowlist shell.py ExecTool._spawn os command injection
- HKUDS nanobot
- Command injection
- CVSS 8.7 High
nanobot: Path traversal via unsanitized WhatsApp document fileName enables arbitrary file write
- HKUDS nanobot
- Path traversal
- CVSS 5.3 Medium
Nanobot < 0.2.1 Denial of Service via Matrix Media Download Handler
- HKUDS nanobot
- Denial of service
- CVSS 7.0 High
Nanobot < 0.2.1 SSRF via Microsoft Teams Channel serviceUrl Poisoning
- HKUDS nanobot
- Server-side request forgery (SSRF)
- CVSS 8.0 High
nanobot: Cross-Site WebSocket Hijacking in WhatsApp Bridge (CVE-2026-2577 Fix Update)
- HKUDS nanobot
- CWE-1385
- CVSS 8.9 High
Zero-Click Indirect Prompt Injection and Authentication Bypass via Email Polling
- HKUDS nanobot
- Code injection
- Authentication bypass
- CVSS 10.0 CriticalCritical · CVSS 9+
Nanobot Unauthenticated WhatsApp Session Hijack via WebSocket Bridge
- HKUDS nanobot
- Authentication bypass