CVE-2026-19243

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-19243

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19243.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-19243

Published

2026-08-07T19:30:13.316Z

Modified

2026-08-09T03:45:58.483657652Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

HKUDS nanobot Shell Allowlist shell.py ExecTool._spawn os command injection

Details

A security vulnerability has been detected in HKUDS nanobot up to 0.2.1. Impacted is the function ExecTool.guardcommand/ExecTool._spawn of the file nanobot/agent/tools/shell.py of the component Shell Allowlist Handler. Such manipulation leads to os command injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.3.0 is recommended to address this issue. The name of the patch is 4562. It is advisable to upgrade the affected component. Multiple issues were reported to the project. They reacted with a high level of professionalism and kindness: "These five reports are variants of the same root cause: validation of shell commands containing multiple segments, wrappers, comments, or chained commands. The issue was fixed by validating every executable shell segment against the configured allowlist".

Database specific

{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-77",
        "CWE-78"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19243.json"
}

References

Affected packages

Git / github.com/hkuds/nanobot

Affected ranges

Type

GIT

Repo

https://github.com/hkuds/nanobot

Events

Introduced

c018c3fb6a5cedf2dcd7bbd0bf4fce5eb9b54bf7

Fixed

3f602fbc8c104b5af27aa4d3520e7dcef2fa70ec

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0.2.0"
        },
        {
            "last_affected": "0.2.0"
        },
        {
            "introduced": "0.2.1"
        },
        {
            "last_affected": "0.2.1"
        }
    ]
}

Affected versions

0.*

0.2.0

0.2.1

v0.*

v0.2.0

v0.2.1

v0.2.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19243.json"