CVE-2026-19245

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-19245

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19245.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-19245

Published

2026-08-07T20:45:12Z

Modified

2026-08-14T03:51:49Z

Severity

1.9 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

HKUDS nanobot Login-shell Environment shell.py ExecTool._prepare_command information disclosure

Details

A flaw has been found in HKUDS nanobot up to 0.2.1. The impacted element is the function ExecTool._prepare_command of the file nanobot/agent/tools/shell.py of the component Login-shell Environment Handler. Executing a manipulation can lead to information disclosure. The attack requires local access. The exploit has been published and may be used. Upgrading to version 0.3.0 is sufficient to resolve this issue. This patch is called 4525. The affected component should be upgraded. Multiple issues were reported to the project. They reacted with a high level of professionalism and kindness: "The report concerns shell startup files reintroducing environment variables when command execution defaults to a login shell. The default was changed so exec does not use a login shell unless explicitly requested".

Database specific

{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-200",
        "CWE-284"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19245.json"
}

References

Affected packages

Git / github.com/hkuds/nanobot

Affected ranges

Type

GIT

Repo

https://github.com/hkuds/nanobot

Events

Introduced

c018c3fb6a5cedf2dcd7bbd0bf4fce5eb9b54bf7

Fixed

3f602fbc8c104b5af27aa4d3520e7dcef2fa70ec

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0.2.0"
        },
        {
            "last_affected": "0.2.0"
        },
        {
            "introduced": "0.2.1"
        },
        {
            "last_affected": "0.2.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*

0.2.0

0.2.1

v0.*

v0.2.0

v0.2.1

v0.2.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19245.json"