CVE-2026-33654

{
  "id": "CVE-2026-33654",
  "sourceIdentifier": "[email protected]",
  "published": "2026-03-27T20:16:32.363",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "nanobot is a personal AI assistant. Prior to version 0.1.6, an indirect prompt injection vulnerability exists in the email channel processing module (`nanobot/channels/email.py`), allowing a remote, unauthenticated attacker to execute arbitrary LLM instructions (and subsequently, system tools) without any interaction from the bot owner. By sending an email containing malicious prompts to the bot's monitored email address, the bot automatically polls, ingests, and processes the email content as highly trusted input, fully bypassing channel isolation and resulting in a stealthy, zero-click attack. Version 0.1.6 patches the issue."
    },
    {
      "lang": "es",
      "value": "nanobot es un asistente personal de IA. Antes de la versión 0.1.6, existe una vulnerabilidad de inyección de prompt indirecta en el módulo de procesamiento del canal de correo electrónico (’nanobot/channels/email.py’), permitiendo a un atacante remoto no autenticado ejecutar instrucciones LLM arbitrarias (y, posteriormente, herramientas del sistema) sin ninguna interacción por parte del propietario del bot. Al enviar un correo electrónico que contiene prompts maliciosos a la dirección de correo electrónico monitoreada del bot, el bot sondea, ingiere y procesa automáticamente el contenido del correo electrónico como entrada de alta confianza, eludiendo completamente el aislamiento del canal y resultando en un ataque sigiloso de cero clics. La versión 0.1.6 corrige el problema."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "HKUDS",
          "product": "nanobot",
          "versions": [
            {
              "version": "< 0.1.4.post6",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 8.9,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "PROOF_OF_CONCEPT",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-03-30T18:59:44.585899Z",
          "id": "CVE-2026-33654",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        },
        {
          "lang": "en",
          "value": "CWE-290"
        },
        {
          "lang": "en",
          "value": "CWE-1336"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:nanobot:nanobot:*:*:*:*:*:python:*:*",
              "versionEndExcluding": "0.1.4",
              "matchCriteriaId": "4613D3BB-4C2B-4F02-9807-E42CFCB21525"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:nanobot:nanobot:0.1.4:-:*:*:*:python:*:*",
              "matchCriteriaId": "E13C548B-00C2-4BC2-8B9D-71E446D00E22"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:nanobot:nanobot:0.1.4:post1:*:*:*:python:*:*",
              "matchCriteriaId": "F3EF840D-CFCC-4BED-B4A4-FEA25E642B79"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:nanobot:nanobot:0.1.4:post2:*:*:*:python:*:*",
              "matchCriteriaId": "96F3AEC6-D3E3-4A2B-A79E-EA44766FAAD9"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:nanobot:nanobot:0.1.4:post3:*:*:*:python:*:*",
              "matchCriteriaId": "CE228286-097D-4F2E-A8D7-DBF71197E50D"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:nanobot:nanobot:0.1.4:post4:*:*:*:python:*:*",
              "matchCriteriaId": "69C2B418-35C6-4F72-8355-018575BA8667"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:nanobot:nanobot:0.1.4:post5:*:*:*:python:*:*",
              "matchCriteriaId": "DC08A055-67E4-4752-A373-CCB966A863BD"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/HKUDS/nanobot/security/advisories/GHSA-4gmr-2vc8-7qh3",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/HKUDS/nanobot/security/advisories/GHSA-4gmr-2vc8-7qh3",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}