The vulnerability is an OS command injection flaw in the ExecTool._guard_command/ExecTool._spawn functions of the Shell Allowlist Handler in HKUDS nanobot. By providing specially crafted command strings, an attacker can bypass the component’s allowlist validation and inject arbitrary shell commands, enabling remote execution of code on the host system. This weakness aligns with CWE-77 (OS Command Injection) and CWE-78 (OS Command Execution).

The issue affects HKUDS nanobot versions up to 0.2.1. The affected component is nanobot/agent/tools/shell.py within the Shell Allowlist Handler. Upgrading to version 0.3.0, which includes patch 4562 that validates every executable shell segment against the configured allowlist, resolves the vulnerability. No other versions or products are listed as affected.

The CVSS score of 5.3 indicates a medium severity vulnerability, and the EPSS score is not available, suggesting limited data on exploitation frequency. The vulnerability is not listed in the CISA KEV catalog, but it has been publicly disclosed and could be leveraged by attackers. The likely attack vector is remote, inferred from the mention that the attack can be executed remotely and by delivering malicious command strings to the nanobot agent. Because the flaw allows arbitrary command execution, the potential impact on confidentiality, integrity, and availability is significant if the affected system is reachable from untrusted networks.