CVE-2026-90808 | HKUDS nanobot up to 0.2.1 ExecTool shell.py ExecTool._guard_command/ExecTool._spawn incomplete blacklist

September 13, 2026 Yanac

A vulnerability marked as critical has been reported in HKUDS nanobot up to 0.2.1. Impacted is the function ExecTool._guard_command/ExecTool._spawn of the file nanobot/agent/tools/shell.py of the component ExecTool. This manipulation causes incomplete blacklist.

The identification of this vulnerability is CVE-2026-90808. It is possible to initiate the attack remotely. There is no exploit available.

Applying a patch is the recommended action to fix this issue.VulDB Recent EntriesRead More