MEDIUM

CVE-2026-90808

2026-09-14 CVSS v3.1

CVSS

6.3

Description

A vulnerability was determined in HKUDS nanobot up to 0.2.1. Impacted is the function ExecTool._guard_command/ExecTool._spawn of the file nanobot/agent/tools/shell.py of the component ExecTool. This manipulation causes incomplete blacklist. It is possible to initiate the attack remotely. Patch name: af582246f141311d574551b7571a517bcc3df750. Applying a patch is the recommended action to fix this issue.

Weakness (CWE)

CWE-183

CWE-184

EPSS Score

0.29%

Probability of exploitation in next 30 days

21.5th percentile

References

https://github.com/HKUDS/nanobot/ https://github.com/HKUDS/nanobot/commit/af582246f141311d574551b7571a517bcc3df750 https://github.com/HKUDS/nanobot/issues/5305 https://github.com/HKUDS/nanobot/pull/5345 https://vuldb.com/cve/CVE-2026-90808 https://vuldb.com/submit/922849 https://vuldb.com/vuln/403310 https://vuldb.com/vuln/403310/cti

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE