CVE-2026-90809 Overview
CVE-2026-90809 is an argument injection vulnerability affecting HKUDS nanobot versions up to 0.2.1. The flaw resides in the ExecTool._guard_command and ExecTool._spawn functions within nanobot/agent/tools/shell.py. Attackers can manipulate command input to bypass the exec.allowPatterns shell-chain guard and execute unintended commands. The vulnerability is remotely exploitable and requires no authentication or user interaction. The maintainers published patch commit af582246f141311d574551b7571a517bcc3df750 to resolve the issue, and the fix is tracked through GitHub Issue #5306 and Pull Request #5345.
Critical Impact
Remote attackers can smuggle additional commands past the ExecTool allow-pattern guard by embedding newline separators, enabling unintended command execution against nanobot agents.
Affected Products
- HKUDS nanobot up to and including version 0.2.1
- Component: ExecTool in nanobot/agent/tools/shell.py
- Deployments using exec.allowPatterns shell-chain filtering
Discovery Timeline
- 2026-09-14 - CVE-2026-90809 published to NVD
- 2026-09-15 - Last updated in NVD database
Technical Details for CVE-2026-90809
Vulnerability Analysis
The vulnerability is classified as argument injection under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component. The ExecTool component in nanobot enforces an allow-pattern policy on shell commands through _guard_command, splitting input on shell operators to validate each command segment individually. The pre-patch parser recognized only ; and | as command separators. Newline and carriage-return characters (\n, \r) were not treated as separators, so a payload placed on a subsequent line was not validated as its own command segment. This omission allowed attackers to smuggle a second command past the allow-pattern check while the first line satisfied the guard.
Root Cause
The root cause is incomplete operator enumeration in the command-parsing logic. Shell interpreters treat newline characters as statement terminators equivalent to ;. Because _guard_command did not include newlines in its operator set, only the leading command was screened against exec.allowPatterns. Any content after a newline was concatenated into the spawned shell invocation without policy checks.
Attack Vector
An attacker who can influence the input passed to ExecTool._spawn supplies a command that begins with an allowed pattern, appends a \n or \r, and follows with an arbitrary command. The guard validates only the first line, while the shell executes the full payload. The attack requires no privileges and no user interaction and can be delivered over the network to any exposed nanobot agent interface.
):
current.append(ch)
operator_len = 1
- elif ch in {";", "|"}:
+ # A newline separates commands just like ";" does, so a payload
+ # smuggled onto its own line must be checked on its own too.
+ elif ch in {";", "|", "\n", "\r"}:
operator_len = 1
if operator_len:
Source: GitHub Commit af58224. The patch adds \n and \r to the set of recognized command separators so each smuggled line is independently validated against exec.allowPatterns.
Detection Methods for CVE-2026-90809
Indicators of Compromise
- Process execution logs from nanobot hosts showing shell child processes whose command line contains embedded newline or carriage-return byte sequences.
- Unexpected child processes spawned by the nanobot agent that do not match documented exec.allowPatterns entries.
- Outbound network connections initiated by shells launched under the nanobot process tree to unfamiliar destinations.
Detection Strategies
- Inspect agent audit logs for ExecTool invocations containing %0A, %0D, \n, or \r sequences in tool arguments.
- Correlate nanobot process ancestry with executed binaries to identify commands that violate the configured allow-pattern policy.
- Deploy runtime file-integrity monitoring on nanobot/agent/tools/shell.py to flag unpatched deployments.
Monitoring Recommendations
- Forward nanobot stdout, stderr, and audit streams to a centralized logging pipeline for retrospective search.
- Alert on any shell process created by the nanobot user account that executes binaries outside an approved allow list.
- Track the GitHub Issue #5306 and Pull Request #5345 discussions for updated indicators.
How to Mitigate CVE-2026-90809
Immediate Actions Required
- Upgrade HKUDS nanobot to a build that includes commit af582246f141311d574551b7571a517bcc3df750.
- Audit existing exec.allowPatterns configurations and remove patterns broader than necessary for agent operation.
- Restrict network exposure of nanobot management and tool interfaces to trusted origins only.
Patch Information
The fix is committed to the HKUDS nanobot repository as af582246f141311d574551b7571a517bcc3df750. The change updates _guard_command to treat \n and \r as command separators, ensuring every smuggled line is validated against the allow-pattern policy. See the GitHub Nanobot Repository and the VulDB CVE-2026-90809 entry for release tracking.
Workarounds
- Run nanobot under a low-privilege service account with no write access to system directories.
- Disable or tightly constrain the ExecTool component if shell execution is not required for the deployment.
- Sanitize any upstream input that reaches ExecTool._spawn by rejecting payloads containing raw newline or carriage-return characters.
# Configuration example: pin nanobot to a patched revision
pip install --upgrade \
git+https://github.com/HKUDS/nanobot.git@af582246f141311d574551b7571a517bcc3df750
# Verify the fix is present in the deployed source tree
grep -n '"\\\\n", "\\\\r"' \
$(python -c "import nanobot, os; print(os.path.join(os.path.dirname(nanobot.__file__), 'agent/tools/shell.py'))")
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.