CVE-2026-19243

A security vulnerability has been detected in HKUDS nanobot up to 0.2.1. Impacted is the function ExecTool._guard_command/ExecTool._spawn of the file nanobot/agent/tools/shell.py of the component Shell Allowlist Handler. Such manipulation leads to os command injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.3.0 is recommended to address this issue. The name of the patch is 4562. It is advisable to upgrade the affected component. Multiple issues were reported to the project. They reacted with a high level of professionalism and kindness: "These five reports are variants of the same root cause: validation of shell commands containing multiple segments, wrappers, comments, or chained commands. The issue was fixed by validating every executable shell segment against the configured allowlist".

• CWE-77
• CWE-78

• https://gist.github.com/YLChen-007/8fcbf8e49e7be568e1a92e9e0414fdba
• https://github.com/HKUDS/nanobot/
• https://github.com/HKUDS/nanobot/issues/4521
• https://github.com/HKUDS/nanobot/pull/4562
• https://github.com/HKUDS/nanobot/releases/tag/v0.3.0
• https://vuldb.com/cve/CVE-2026-19243
• https://vuldb.com/submit/865112
• https://vuldb.com/submit/865114
• https://vuldb.com/submit/865115
• https://vuldb.com/submit/865119
• https://vuldb.com/submit/865121
• https://vuldb.com/vuln/386997
• https://vuldb.com/vuln/386997/cti

Published

Aug 7, 2026

Last Modified

Aug 12, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-19230A vulnerability was identified in SourceCodester Photo Share…3.5
• CVE-2026-19231A security flaw has been discovered in SourceCodester Simple…7.3
• CVE-2026-19232Adobe Experience Manager is affected by an Incorrect Authori…9.9
• CVE-2026-19233CWE-918: Server-Side Request Forgery (SSRF) vulnerability ex…8.6
• CVE-2026-19234Power Systems Firmware FW1120.00, FW1110.00 through FW1110.3…8.2
• CVE-2026-1924The Aruba HiSpeed Cache plugin for WordPress is vulnerable t…4.3
• CVE-2026-19244A vulnerability was detected in HKUDS nanobot up to 0.2.1. T…4.7
• CVE-2026-19245A flaw has been found in HKUDS nanobot up to 0.2.1. The impa…3.3
• CVE-2026-19246A vulnerability has been found in HKUDS nanobot up to 0.2.1.…6.3
• CVE-2026-19248QDomDocument XML parsing is vulnerable to a remotely-trigger…7.1
• CVE-2026-1925The EmailKit – Email Customizer for WooCommerce & WP plugin …4.3
• CVE-2026-19251The Ultimate Member WordPress plugin before 2.13.0 does not…5.3