Description

A vulnerability has been found in HKUDS nanobot up to 0.2.1. This affects the function _download_image_data_url of the file nanobot/providers/image_generation.py of the component Provider-returned Image URL Handler. The manipulation leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 5095. It is recommended to apply a patch to fix this issue. The vendor explains: "We confirm that provider-returned image URLs required the same SSRF protections applied to other network retrieval paths. (...) The patch is currently available on main and is planned for the next patch release, v0.3.1."

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-07T21:17:27.857Z",
  "pubdate": "2026-08-07T21:17:27.857Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability has been identified in HKUDS nanobot up to version 0.2.1, specifically within the Provider-returned Image URL Handler component. This security flaw resides in the _download_image_data_url function located in nanobot/providers/image_generation.py. The vulnerability allows remote attackers to manipulate image retrieval URLs, forcing the vulnerable server to dispatch arbitrary outbound HTTP requests to internal or external destinations. Successful exploitation can lead to unauthorized access to internal network resources, sensitive data exposure, and potential lateral movement within the affected infrastructure. The attack can be executed remotely without requiring prior authentication or specialized privileges, posing a significant risk to deployments utilizing unpatched versions of the software. Public disclosure of the exploit increases the likelihood of active targeting, necessitating immediate defensive measures.",
  "technicalDetails": "The vulnerability stems from inadequate input validation and missing security controls within the image retrieval mechanism of HKUDS nanobot up to version 0.2.1. Specifically, the _download_image_data_url function inside nanobot/providers/image_generation.py processes provider-returned image URLs without enforcing the rigorous Server-Side Request Forgery (SSRF) protections typically applied to other network retrieval paths within the application. Because the application blindly trusts or insufficiently sanitizes the supplied URL scheme and destination address before initiating an outbound connection, an attacker can supply malicious or crafted URLs pointing to internal services, loopback interfaces (e.g., 127.0.0.1 or ::1), or metadata endpoints associated with cloud environments.\nThe attack flow proceeds as follows: First, an attacker leverages the remote attack surface exposed by the application to submit or manipulate data that influences the provider-returned image URL handled by the vulnerable component. Second, when the application attempts to fetch the image data via the _download_image_data_url function, it initiates a backend network request directed at the attacker-specified target. Third, the server processes the response from the targeted internal or external resource, potentially leaking internal application states, service banners, or sensitive metadata back to the attacker or causing unintended state changes via cross-site request forgery patterns within the local network.\nThe affected component is the Provider-returned Image URL Handler, encompassing the specific function _download_image_data_url in nanobot/providers/image_generation.py. Affected versions include all deployments up to 0.2.1. Exploitation requires network exposure of the vulnerable interface, but does not necessitate authentication or specific user privileges. The lack of strict allowlisting, domain validation, or IP blocklisting for outbound network connections facilitates this behavior, allowing the underlying HTTP client library to resolve and query arbitrary network locations on behalf of the attacker."
}