HIGH

CVE-2026-90809

2026-09-14 CVSS v3.1

CVSS

7.3

Description

A vulnerability was identified in HKUDS nanobot up to 0.2.1. The affected element is the function ExecTool._guard_command/ExecTool._spawn of the file nanobot/agent/tools/shell.py of the component ExecTool. Such manipulation leads to argument injection. It is possible to launch the attack remotely. The name of the patch is af582246f141311d574551b7571a517bcc3df750. It is best practice to apply a patch to resolve this issue.

Weakness (CWE)

CWE-74 Injection

CWE-88

EPSS Score

0.33%

Probability of exploitation in next 30 days

25.9th percentile

References

https://github.com/HKUDS/nanobot/ https://github.com/HKUDS/nanobot/commit/af582246f141311d574551b7571a517bcc3df750 https://github.com/HKUDS/nanobot/issues/5306 https://github.com/HKUDS/nanobot/pull/5345 https://vuldb.com/cve/CVE-2026-90809 https://vuldb.com/submit/922850 https://vuldb.com/vuln/403311 https://vuldb.com/vuln/403311/cti

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE