CVE-2026-19245

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-19245", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-08-07T12:07:40.156Z", "datePublished": "2026-08-07T20:45:12.889Z", "dateUpdated": "2026-08-10T13:30:42.468Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-08-07T20:45:12.889Z"}, "title": "HKUDS nanobot Login-shell Environment shell.py ExecTool._prepare_command information disclosure", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-200", "lang": "en", "description": "Information Disclosure"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-284", "lang": "en", "description": "Improper Access Controls"}]}], "affected": [{"vendor": "HKUDS", "product": "nanobot", "versions": [{"version": "0.2.0", "status": "affected"}, {"version": "0.2.1", "status": "affected"}, {"version": "0.3.0", "status": "unaffected"}], "cpes": ["cpe:2.3:a:nanobot:nanobot:*:*:*:*:*:*:*:*"], "modules": ["Login-shell Environment Handler"]}], "descriptions": [{"lang": "en", "value": "A flaw has been found in HKUDS nanobot up to 0.2.1. The impacted element is the function ExecTool._prepare_command of the file nanobot/agent/tools/shell.py of the component Login-shell Environment Handler. Executing a manipulation can lead to information disclosure. The attack requires local access. The exploit has been published and may be used. Upgrading to version 0.3.0 is sufficient to resolve this issue. This patch is called 4525. The affected component should be upgraded. Multiple issues were reported to the project. They reacted with a high level of professionalism and kindness: \"The report concerns shell startup files reintroducing environment variables when command execution defaults to a login shell. The default was changed so exec does not use a login shell unless explicitly requested\"."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.3, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.3, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 1.7, "vectorString": "AV:L/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2026-08-07T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-08-07T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-08-07T14:13:01.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Eric-c (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/386999", "name": "VDB-386999 | HKUDS nanobot Login-shell Environment shell.py ExecTool._prepare_command information disclosure", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/386999/cti", "name": "VDB-386999 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-19245", "name": "CVE-2026-19245 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/865117", "name": "Submit #865117 | HKUDS nanobot 0.2.1 Sensitive Information Exposure via Login Shell Startup Files (CWE-200)", "tags": ["third-party-advisory"]}, {"url": "https://github.com/HKUDS/nanobot/issues/4518", "tags": ["issue-tracking"]}, {"url": "https://gist.github.com/YLChen-007/b25f3f185478e0b2cd0e727bf5c5ed9b", "tags": ["exploit"]}, {"url": "https://github.com/HKUDS/nanobot/pull/4525", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/HKUDS/nanobot/releases/tag/v0.3.0", "tags": ["patch"]}, {"url": "https://github.com/HKUDS/nanobot/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202608"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-10T13:30:28.399321Z", "id": "CVE-2026-19245", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-10T13:30:42.468Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-19245", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-10T13:30:28.399321Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-10T13:30:38.357Z"}}], "cna": {"title": "HKUDS nanobot Login-shell Environment shell.py ExecTool._prepare_command information disclosure", "credits": [{"lang": "en", "type": "reporter", "value": "Eric-c (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 1.7, "vectorString": "AV:L/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:nanobot:nanobot:*:*:*:*:*:*:*:*"], "vendor": "HKUDS", "modules": ["Login-shell Environment Handler"], "product": "nanobot", "versions": [{"status": "affected", "version": "0.2.0"}, {"status": "affected", "version": "0.2.1"}, {"status": "unaffected", "version": "0.3.0"}]}], "timeline": [{"lang": "en", "time": "2026-08-07T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-08-07T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-08-07T14:13:01.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/386999", "name": "VDB-386999 | HKUDS nanobot Login-shell Environment shell.py ExecTool._prepare_command information disclosure", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/386999/cti", "name": "VDB-386999 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-19245", "name": "CVE-2026-19245 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/865117", "name": "Submit #865117 | HKUDS nanobot 0.2.1 Sensitive Information Exposure via Login Shell Startup Files (CWE-200)", "tags": ["third-party-advisory"]}, {"url": "https://github.com/HKUDS/nanobot/issues/4518", "tags": ["issue-tracking"]}, {"url": "https://gist.github.com/YLChen-007/b25f3f185478e0b2cd0e727bf5c5ed9b", "tags": ["exploit"]}, {"url": "https://github.com/HKUDS/nanobot/pull/4525", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/HKUDS/nanobot/releases/tag/v0.3.0", "tags": ["patch"]}, {"url": "https://github.com/HKUDS/nanobot/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202608"], "descriptions": [{"lang": "en", "value": "A flaw has been found in HKUDS nanobot up to 0.2.1. The impacted element is the function ExecTool._prepare_command of the file nanobot/agent/tools/shell.py of the component Login-shell Environment Handler. Executing a manipulation can lead to information disclosure. The attack requires local access. The exploit has been published and may be used. Upgrading to version 0.3.0 is sufficient to resolve this issue. This patch is called 4525. The affected component should be upgraded. Multiple issues were reported to the project. They reacted with a high level of professionalism and kindness: \"The report concerns shell startup files reintroducing environment variables when command execution defaults to a login shell. The default was changed so exec does not use a login shell unless explicitly requested\"."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "Information Disclosure"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "Improper Access Controls"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-08-07T20:45:12.889Z"}}}, "cveMetadata": {"cveId": "CVE-2026-19245", "state": "PUBLISHED", "dateUpdated": "2026-08-10T13:30:42.468Z", "dateReserved": "2026-08-07T12:07:40.156Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-08-07T20:45:12.889Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:nanobot:nanobot:*:*:*:*:*:*:*:*"], "modules": ["Login-shell Environment Handler"], "product": "nanobot", "vendor": "HKUDS", "versions": [{"status": "affected", "version": "0.2.0"}, {"status": "affected", "version": "0.2.1"}, {"status": "unaffected", "version": "0.3.0"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw has been found in HKUDS nanobot up to 0.2.1. The impacted element is the function ExecTool._prepare_command of the file nanobot/agent/tools/shell.py of the component Login-shell Environment Handler. Executing a manipulation can lead to information disclosure. The attack requires local access. The exploit has been published and may be used. Upgrading to version 0.3.0 is sufficient to resolve this issue. This patch is called 4525. The affected component should be upgraded. Multiple issues were reported to the project. They reacted with a high level of professionalism and kindness: \"The report concerns shell startup files reintroducing environment variables when command execution defaults to a login shell. The default was changed so exec does not use a login shell unless explicitly requested\"."}, {"lang": "es", "value": "Se ha encontrado un fallo en HKUDS nanobot hasta la versi\u00f3n 0.2.1. El elemento afectado es la funci\u00f3n ExecTool._prepare_command del archivo nanobot/agent/tools/shell.py del componente Login-shell Environment Gestor. La ejecuci\u00f3n de una manipulaci\u00f3n puede llevar a una revelaci\u00f3n de informaci\u00f3n. El ataque requiere acceso local. El exploit ha sido publicado y puede ser utilizado. Actualizar a la versi\u00f3n 0.3.0 es suficiente para resolver este problema. Este parche se llama 4525. El componente afectado deber\u00eda ser actualizado. M\u00faltiples problemas fueron reportados al proyecto. Reaccionaron con un alto nivel de profesionalidad y amabilidad: \u2019El informe se refiere a archivos de inicio de shell que reintroducen variables de entorno cuando la ejecuci\u00f3n de comandos por defecto utiliza un shell de inicio de sesi\u00f3n. El valor predeterminado se cambi\u00f3 para que exec no utilice un shell de inicio de sesi\u00f3n a menos que se solicite expl\u00edcitamente\u2019."}], "id": "CVE-2026-19245", "lastModified": "2026-10-23T20:10:00.160", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 1.7, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.1, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-19245", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-10T13:30:28.399321Z", "version": "2.0.3"}}]}, "published": "2026-08-07T21:17:27.667", "references": [{"source": "cna@vuldb.com", "url": "https://gist.github.com/YLChen-007/b25f3f185478e0b2cd0e727bf5c5ed9b"}, {"source": "cna@vuldb.com", "url": "https://github.com/HKUDS/nanobot/"}, {"source": "cna@vuldb.com", "url": "https://github.com/HKUDS/nanobot/issues/4518"}, {"source": "cna@vuldb.com", "url": "https://github.com/HKUDS/nanobot/pull/4525"}, {"source": "cna@vuldb.com", "url": "https://github.com/HKUDS/nanobot/releases/tag/v0.3.0"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-19245"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/865117"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/386999"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/386999/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-284"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.2.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.2.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "0.3.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "nanobot", "source": "cna", "vendor": "HKUDS"}, "product": "nanobot", "vendor": "hkuds"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "nanobot", "vendor": "nanobot"}], "created": "2026-08-07T22:30:03.262998+00:00", "updated": "2026-08-08T01:00:11.964110+00:00", "vendors": ["hkuds", "hkuds$PRODUCT$nanobot", "nanobot", "nanobot$PRODUCT$nanobot"]}