Description
A vulnerability has been found in HKUDS nanobot up to 0.2.1. This affects the function _download_image_data_url of the file nanobot/providers/image_generation.py of the component Provider-returned Image URL Handler. The manipulation leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 5095. It is recommended to apply a patch to fix this issue. The vendor explains: "We confirm that provider-returned image URLs required the same SSRF protections applied to other network retrieval paths. (...) The patch is currently available on main and is planned for the next patch release, v0.3.1."
Published: 2026-08-07
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in the _download_image_data_url function of HKUDS nanobot's Provider‑returned Image URL Handler. It permits a server‑side request forgery (SSRF) that can be triggered remotely by supplying a specially crafted image URL. The flaw allows the vulnerable component to generate outbound HTTP(S) requests on behalf of the server, potentially reaching internal services, exposing sensitive data, or executing harmful actions on networked resources. This is a typical injection‑type weakness (CWE‑918) affecting confidentiality and integrity of systems accessed via the forged requests.

Affected Systems

HKUDS nanobot versions up to and including 0.2.1 are affected. The affected code resides in the nanobot providers image_generation module. No other vendors or products are reported to be impacted.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote; as the flaw is triggered by a provider‑supplied URL, an adversary can initiate the request from an external network. The exploit has been publicly disclosed and patching is recommended.

Generated by OpenCVE AI on August 7, 2026 at 22:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update nanobot to v0.3.1 or later, which includes the applied patch 5095.
  • If upgrading immediately is not possible, apply patch 5095 to the current codebase to correct the SSRF logic.
  • Implement an allow‑list for image URLs or block provider‑supplied URLs until the patch is applied.
  • Configure firewall or network segmentation to restrict outbound connections from the nanobot process to only trusted internal or external endpoints.

Generated by OpenCVE AI on August 7, 2026 at 22:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 07 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in HKUDS nanobot up to 0.2.1. This affects the function _download_image_data_url of the file nanobot/providers/image_generation.py of the component Provider-returned Image URL Handler. The manipulation leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 5095. It is recommended to apply a patch to fix this issue. The vendor explains: "We confirm that provider-returned image URLs required the same SSRF protections applied to other network retrieval paths. (...) The patch is currently available on main and is planned for the next patch release, v0.3.1."
Title HKUDS nanobot Provider-returned Image URL image_generation.py _download_image_data_url server-side request forgery
First Time appeared Nanobot
Nanobot nanobot
Weaknesses CWE-918
CPEs cpe:2.3:a:nanobot:nanobot:*:*:*:*:*:*:*:*
Vendors & Products Nanobot
Nanobot nanobot
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Nanobot Nanobot
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-07T21:00:14.107Z

Reserved: 2026-08-07T12:07:59.093Z

Link: CVE-2026-19246

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-08T01:00:11Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)