nanobot, a personal AI assistant, contains an indirect prompt injection flaw in its email channel module that allows an unauthenticated attacker to send a single email with malicious prompts to the bot's monitored address; the bot automatically polls and treats the email content as highly trusted input, bypassing channel isolation and enabling the attacker to trigger arbitrary LLM instructions and subsequently execute system tools, effectively granting remote code execution.

The vulnerability affects the nanobot product from HKUDS; all versions older than 0.1.6 are impacted while version 0.1.6 and later include the necessary patch.

With a CVSS score of 8.9, the flaw is of high severity. No EPSS data is available and the flaw is not listed in the CISA KEV catalog, but the attack vector is a zero-click, email-based exploit that requires no interaction from the bot owner, making it highly likely to be abused by attackers who can execute arbitrary system tools.