Description

A flaw has been found in HKUDS nanobot up to 0.2.1. The impacted element is the function ExecTool._prepare_command of the file nanobot/agent/tools/shell.py of the component Login-shell Environment Handler. Executing a manipulation can lead to information disclosure. The attack requires local access. The exploit has been published and may be used. Upgrading to version 0.3.0 is sufficient to resolve this issue. This patch is called 4525. The affected component should be upgraded. Multiple issues were reported to the project. They reacted with a high level of professionalism and kindness: "The report concerns shell startup files reintroducing environment variables when command execution defaults to a login shell. The default was changed so exec does not use a login shell unless explicitly requested".

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.3",
  "pubDate": "2026-08-07T21:17:27.667Z",
  "pubdate": "2026-08-07T21:17:27.667Z",
  "executiveSummary": "A vulnerability has been identified in HKUDS nanobot versions up to 0.2.1, specifically residing within the Login-shell Environment Handler component. The flaw stems from the function ExecTool._prepare_command in nanobot/agent/tools/shell.py, which improperly utilizes a login shell by default during command execution, thereby reintroducing sensitive environment variables from shell startup files. Exploitation of this vulnerability can lead to unauthorized information disclosure of sensitive environment data. The attack vector requires local access to the target system where the affected software is deployed. An exploit has been publicly released and is available for use, elevating the operational risk. Mitigation requires upgrading the affected component to version 0.3.0, which applies patch 4525 to modify the default execution behavior so that a login shell is no longer invoked unless explicitly requested.",
  "technicalDetails": "The vulnerability resides in the Login-shell Environment Handler component of HKUDS nanobot up to 0.2.1, specifically within the ExecTool._prepare_command function located in the nanobot/agent/tools/shell.py file. The root cause of the security issue involves the default behavior of command execution utilizing a login shell. When a login shell is invoked by default during command execution, shell startup files (such as .bash_profile, .bashrc, or equivalent profile scripts) are automatically sourced and executed. This behavior inadvertently reintroduces sensitive environment variables, configuration parameters, and authentication tokens into the active execution context.\nThe exploitation method requires local access to the host system executing the nanobot instance. Because an exploit has been published, threat actors with local access can leverage the flaw to inspect, harvest, or exfiltrate sensitive environment variables that are improperly exposed through the login shell environment initialization. The attack flow involves the adversary executing or manipulating tool commands within the environment handler, triggering the vulnerable ExecTool._prepare_command routine. Since the routine defaults to spawning a login shell, the shell startup files load restricted environment data into the process memory or execution output stream, resulting in unauthorized information disclosure.\nThe affected versions include HKUDS nanobot up to version 0.2.1. Authentication requirements depend on local system access boundaries, and the privilege requirements correspond to the local user context executing the vulnerable nanobot agent. The vulnerability does not require network exposure for initial exploitation, as it is fundamentally a local environment handling flaw. Post-exploitation impact is characterized by the leakage of sensitive data stored within environment variables, which may include API keys, database credentials, or internal configuration secrets accessible to the agent process."
}