Read the docs
TI-2026-26034 Aliases CVE-2026-33654

Zero-Click Indirect Prompt Injection and Authentication Bypass via Email Polling

Priority HIGH 80CWE-1336Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution, Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-1336 and CWE-290.

Summary

nanobot is a personal AI assistant. Prior to version 0.1.6, an indirect prompt injection vulnerability exists in the email channel processing module (`nanobot/channels/email.py`), allowing a remote, unauthenticated attacker to execute arbitrary LLM instructions (and subsequently, system tools) without any interaction from the bot owner. By sending an email containing malicious prompts to the bot's monitored email address, the bot automatically polls, ingests, and processes the email content as highly trusted input, fully bypassing channel isolation and resulting in a stealthy, zero-click attack. Version 0.1.6 patches the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00508 43rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed nanobot (HKUDS): 0.1.4.post6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
HKUDSnanobotbefore 0.1.4.post60.1.4.post6Patch availableCNA
  • nanobot VendorHKUDS Affected before 0.1.4.post6 Fixed in 0.1.4.post6 Patch available CNA

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:nanobot:nanobot:*:*:*:*:*:python:*:*before 0.1.4VulnerableNanobot
cpe:2.3:a:nanobot:nanobot:0.1.4:-:*:*:*:python:*:*0.1.4VulnerableNanobot
cpe:2.3:a:nanobot:nanobot:0.1.4:post1:*:*:*:python:*:*0.1.4 post1VulnerableNanobot
cpe:2.3:a:nanobot:nanobot:0.1.4:post2:*:*:*:python:*:*0.1.4 post2VulnerableNanobot
cpe:2.3:a:nanobot:nanobot:0.1.4:post3:*:*:*:python:*:*0.1.4 post3VulnerableNanobot
cpe:2.3:a:nanobot:nanobot:0.1.4:post4:*:*:*:python:*:*0.1.4 post4VulnerableNanobot
cpe:2.3:a:nanobot:nanobot:0.1.4:post5:*:*:*:python:*:*0.1.4 post5VulnerableNanobot
  • cpe:2.3:a:nanobot:nanobot:*:*:*:*:*:python:*:* Versions before 0.1.4 Vulnerable ·Nanobot
  • cpe:2.3:a:nanobot:nanobot:0.1.4:-:*:*:*:python:*:* Versions 0.1.4 Vulnerable ·Nanobot
  • cpe:2.3:a:nanobot:nanobot:0.1.4:post1:*:*:*:python:*:* Versions 0.1.4 post1 Vulnerable ·Nanobot
  • cpe:2.3:a:nanobot:nanobot:0.1.4:post2:*:*:*:python:*:* Versions 0.1.4 post2 Vulnerable ·Nanobot
  • cpe:2.3:a:nanobot:nanobot:0.1.4:post3:*:*:*:python:*:* Versions 0.1.4 post3 Vulnerable ·Nanobot
  • cpe:2.3:a:nanobot:nanobot:0.1.4:post4:*:*:*:python:*:* Versions 0.1.4 post4 Vulnerable ·Nanobot
  • cpe:2.3:a:nanobot:nanobot:0.1.4:post5:*:*:*:python:*:* Versions 0.1.4 post5 Vulnerable ·Nanobot

Remediation

  • Fix · CNA nanobot (HKUDS) Fixed in 0.1.4.post6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33654
  2. 2026-10-25 EPSS moved to the below the 50th percentile

References

Exploit 1

  • TI-2026-44237 LightRAG: Missing Authentication for Critical API Functions in Default Configuration CVSS 3.1CRITICAL 9.8
  • TI-2026-78721 Missing authentication in HKUDS Vibe-Trading FastAPI server enables RCE CVSS 4.0CRITICAL 9.3
  • TI-2026-44184 Improper authentication in HKUDS LightRAG CVSS 4.0CRITICAL 9.3
  • TI-2026-62432 HKUDS nanobot before 0.3.0 Server-Side Request Forgery via WebFetchTool CVSS 4.0CRITICAL 9.2
  • TI-2026-25310 DeepCode 1.2.0 Path Traversal via SPA Catch-All Route in main.py CVSS 4.0HIGH 8.7
  • TI-2026-27692 nanobot: Cross-Site WebSocket Hijacking in WhatsApp Bridge (CVE-2026-2577 Fix Update) CVSS 3.1CRITICAL 9.3
See all 47 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences