CVE-2026-19245: HKUDS Nanobot Information Disclosure Flaw

CVE-2026-19245 Overview

CVE-2026-19245 affects HKUDS nanobot up to version 0.2.1. The flaw resides in the ExecTool._prepare_command function within nanobot/agent/tools/shell.py, part of the Login-shell Environment Handler component. Command execution defaulted to a login shell, which caused shell startup files to reintroduce environment variables into the child process context. An attacker with local access can leverage this behavior to trigger information disclosure [CWE-200]. The maintainers addressed the issue in version 0.3.0 through patch 4525 by changing the default so exec does not use a login shell unless explicitly requested.

Critical Impact
Local attackers can obtain environment variables reintroduced by shell startup files during command execution, exposing sensitive configuration data.

Affected Products

HKUDS nanobot versions up to and including 0.2.1
Component: Login-shell Environment Handler (nanobot/agent/tools/shell.py)
Fixed in: HKUDS nanobot 0.3.0

Discovery Timeline

2026-08-07 - CVE-2026-19245 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-19245

Vulnerability Analysis

The vulnerability is an information disclosure issue [CWE-200] in the nanobot agent's shell execution tool. The ExecTool._prepare_command function invoked commands through a login shell by default. When a login shell starts, it processes user startup files such as .bash_profile, .profile, or .bashrc, which typically export environment variables including API keys, tokens, and other configuration. These values are then injected into the executed command's environment, making them visible to the process and any output paths it produces.

Exploitation requires local access to the host running nanobot. An attacker with the ability to influence command execution through the agent can observe environment values that would not normally be part of the intended execution context.

Root Cause

The root cause is an insecure default configuration in ExecTool._prepare_command. By defaulting command execution to a login shell, the tool inherited environment variables set by user shell startup scripts. The fix, released as pull request 4525 in version 0.3.0, changes the default so that exec does not use a login shell unless the caller explicitly requests one.

Attack Vector

The attack vector is local. An actor with local access and low privileges can trigger command execution paths through the nanobot agent to capture environment variables reintroduced by the login shell. No user interaction is required. Refer to the GitHub Nanobot Issue #4518 and GitHub Nanobot Pull Request #4525 for the maintainers' technical description of the flaw and its remediation.

Detection Methods for CVE-2026-19245

Indicators of Compromise

Unexpected invocations of login shells (bash -l, sh -l) spawned by the nanobot agent process tree.
Access to user shell startup files such as .bash_profile, .profile, or .bashrc by the nanobot process.
Nanobot output or logs containing environment variable values that should not be exposed to agent tool consumers.

Detection Strategies

Inventory hosts running HKUDS nanobot and identify versions at or below 0.2.1.
Monitor process creation events where the parent is the nanobot agent and the child command line includes login-shell flags.
Inspect nanobot logs and captured tool output for environment variable leakage patterns such as API_KEY=, TOKEN=, or credential strings.

Monitoring Recommendations

Enable process command-line auditing on Linux hosts hosting nanobot workloads to capture shell invocation flags.
Alert on reads of user shell startup files by service accounts running nanobot.
Rotate any credentials that were present in shell startup files on affected hosts prior to upgrade.

How to Mitigate CVE-2026-19245

Immediate Actions Required

Upgrade HKUDS nanobot to version 0.3.0 or later, which includes patch 4525.
Audit user shell startup files on hosts running nanobot and remove secrets that should not be inherited by agent-executed commands.
Rotate credentials that may have been exposed through the login-shell environment inheritance.

Patch Information

The maintainers resolved the issue in GitHub Nanobot Release v0.3.0. The change modifies the default behavior of ExecTool._prepare_command so that exec does not use a login shell unless explicitly requested. Full technical context is available in GitHub Nanobot Pull Request #4525 and the VulDB CVE-2026-19245 entry.

Workarounds

If upgrade is not immediately feasible, remove sensitive environment exports from user shell startup files on the nanobot host.
Run nanobot under a dedicated, minimally privileged service account whose startup files contain no secrets.
Restrict local access to the host to trusted operators only until the upgrade to 0.3.0 is applied.

bash

# Configuration example
# Verify installed nanobot version and upgrade
pip show nanobot | grep -i version
pip install --upgrade 'nanobot>=0.3.0'