Exploitable Incomplete Blacklist in HKUDS Nanobot ExecTool
CVE-2026-90808

5.3MEDIUM

Key Information:

Vendor

Hkuds

Status
Nanobot
Vendor
CVE Published:
14 September 2026

What is CVE-2026-90808?

The HKUDS Nanobot, specifically the ExecTool component, is susceptible to a vulnerability due to an incomplete blacklist implemented in the ExecTool._guard_command and ExecTool._spawn functions. This flaw, found in the nanobot/agent/tools/shell.py file, can be exploited remotely, enabling attackers to bypass security checks and execute unauthorized commands. Users are strongly encouraged to apply the patch (commit af582246f141311d574551b7571a517bcc3df750) to mitigate this risk and enhance the security posture of their systems.

Affected Version(s)

nanobot 0.2.0

nanobot 0.2.1

References

https://vuldb.com/vuln/403310
vdb-entrytechnical-description
https://vuldb.com/vuln/403310/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-90808
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Eric-a (VulDB User)
.