CVE-2026-90808: HKUDS nanobot RCE Vulnerability

CVE-2026-90808 Overview

CVE-2026-90808 is an incomplete blacklist vulnerability [CWE-183] affecting HKUDS nanobot versions up to 0.2.1. The flaw resides in the ExecTool._guard_command and ExecTool._spawn functions within nanobot/agent/tools/shell.py. The command guard fails to treat newline (\n) and carriage return (\r) characters as command separators, allowing attackers to smuggle unintended commands past the exec.allowPatterns filter. The vulnerability is remotely exploitable and requires low privileges. A fix is available in commit af582246f141311d574551b7571a517bcc3df750.

Critical Impact
Attackers with low privileges can bypass the shell command allow-list in nanobot and execute unintended commands through newline-smuggled payloads against the agent's shell execution tool.

Affected Products

HKUDS nanobot versions up to and including 0.2.1
Component: ExecTool in nanobot/agent/tools/shell.py
Functions: ExecTool._guard_command and ExecTool._spawn

Discovery Timeline

2026-09-14 - CVE-2026-90808 published to the National Vulnerability Database
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90808

Vulnerability Analysis

The vulnerability is an incomplete blacklist [CWE-183] in the shell command guard used by nanobot's agent execution tool. ExecTool._guard_command splits input on shell operators to validate each sub-command against the configured exec.allowPatterns. The original implementation only recognized ; and | as command separators. Newline characters, which POSIX shells interpret as statement terminators equivalent to ;, were not included in the operator set. As a result, a command payload placed on a separate line evades per-sub-command validation and reaches ExecTool._spawn intact.

Root Cause

The root cause is a missing entry in the character set used by the command parser. In nanobot/agent/tools/shell.py, the branch that detects command separators tested membership in {";", "|"} only. Because Python's subprocess and the underlying shell treat \n and \r as statement boundaries, any content following an embedded newline is executed as an independent command that was never presented to the allow-pattern check.

Attack Vector

An authenticated user who can submit input to the nanobot agent's shell tool can craft a request where the first line matches an allowed pattern and subsequent lines contain arbitrary commands. Because the guard treats the entire multi-line string as one command for validation purposes, the smuggled lines pass through and are executed by the spawned shell process. Exploitation is remote and requires no user interaction beyond submitting the crafted prompt or tool call.

python

                ):
                    current.append(ch)
                    operator_len = 1
-                elif ch in {";", "|"}:
+                # A newline separates commands just like ";" does, so a payload
+                # smuggled onto its own line must be checked on its own too.
+                elif ch in {";", "|", "\n", "\r"}:
                    operator_len = 1

            if operator_len:

Source: GitHub Commit af582246. The patch adds \n and \r to the set of recognized separator characters so each smuggled line is validated independently against exec.allowPatterns.

Detection Methods for CVE-2026-90808

Indicators of Compromise

Agent shell tool invocations containing embedded \n or \r characters within a single command string
Process trees where a nanobot agent process spawns child commands not present in the configured exec.allowPatterns
Unexpected outbound network connections, file writes, or interpreter launches (sh, bash, python, curl, wget) originating from the nanobot agent process
Audit log entries showing multi-line payloads submitted to ExecTool._spawn

Detection Strategies

Enable verbose logging for ExecTool._guard_command and record both the raw input and the parsed sub-commands for correlation
Alert on any nanobot child process whose command line does not match the deployed allow-list
Compare the deployed nanobot/agent/tools/shell.py against the fixed version at commit af582246f141311d574551b7571a517bcc3df750 to confirm patch application

Monitoring Recommendations

Monitor endpoint EDR telemetry for the nanobot service account launching interactive shells or scripting interpreters
Ingest nanobot application logs into a centralized SIEM and hunt for tool inputs containing CR or LF bytes
Track version drift of the HKUDS nanobot package across deployed hosts to identify unpatched instances

How to Mitigate CVE-2026-90808

Immediate Actions Required

Upgrade HKUDS nanobot to a version that includes commit af582246f141311d574551b7571a517bcc3df750 or later
Audit exec.allowPatterns configurations and remove any patterns broader than necessary
Restrict access to the nanobot agent interface to trusted, authenticated users only
Run the nanobot process under a least-privileged system account with no shell login

Patch Information

Apply the upstream fix from GitHub Pull Request #5345, tracked as GitHub Issue #5305 and merged in commit af582246f141311d574551b7571a517bcc3df750. The patch extends the shell operator character set in ExecTool._guard_command to include \n and \r, ensuring each line of a multi-line payload is validated against exec.allowPatterns. Additional context is available in the VulDB CVE-2026-90808 entry.

Workarounds

Deploy an input sanitizer in front of the agent that rejects tool inputs containing \n or \r characters
Configure exec.allowPatterns to match only fully-qualified, single-command invocations with strict argument constraints
Execute the nanobot process inside a container or sandbox that blocks unexpected child processes and outbound network egress

bash

# Verify the deployed nanobot version includes the fix
pip show nanobot | grep -i version
cd nanobot && git log --oneline | grep af58224

# Confirm the patched separator set is present in shell.py
grep -n '";", "|", "\\n", "\\r"' nanobot/agent/tools/shell.py