CVE-2026-33654

{"id": "CVE-2026-33654", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33654", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-03-30T18:59:44.585899Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "HKUDS", "product": "nanobot", "versions": [{"status": "affected", "version": "< 0.1.4.post6"}]}]}], "published": "2026-03-27T20:16:32.363", "references": [{"url": "https://github.com/HKUDS/nanobot/security/advisories/GHSA-4gmr-2vc8-7qh3", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/HKUDS/nanobot/security/advisories/GHSA-4gmr-2vc8-7qh3", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-290"}, {"lang": "en", "value": "CWE-1336"}]}], "descriptions": [{"lang": "en", "value": "nanobot is a personal AI assistant. Prior to version 0.1.6, an indirect prompt injection vulnerability exists in the email channel processing module (`nanobot/channels/email.py`), allowing a remote, unauthenticated attacker to execute arbitrary LLM instructions (and subsequently, system tools) without any interaction from the bot owner. By sending an email containing malicious prompts to the bot's monitored email address, the bot automatically polls, ingests, and processes the email content as highly trusted input, fully bypassing channel isolation and resulting in a stealthy, zero-click attack. Version 0.1.6 patches the issue."}, {"lang": "es", "value": "nanobot es un asistente personal de IA. Antes de la versi\u00f3n 0.1.6, existe una vulnerabilidad de inyecci\u00f3n de prompt indirecta en el m\u00f3dulo de procesamiento del canal de correo electr\u00f3nico (\u2019nanobot/channels/email.py\u2019), permitiendo a un atacante remoto no autenticado ejecutar instrucciones LLM arbitrarias (y, posteriormente, herramientas del sistema) sin ninguna interacci\u00f3n por parte del propietario del bot. Al enviar un correo electr\u00f3nico que contiene prompts maliciosos a la direcci\u00f3n de correo electr\u00f3nico monitoreada del bot, el bot sondea, ingiere y procesa autom\u00e1ticamente el contenido del correo electr\u00f3nico como entrada de alta confianza, eludiendo completamente el aislamiento del canal y resultando en un ataque sigiloso de cero clics. La versi\u00f3n 0.1.6 corrige el problema."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nanobot:nanobot:*:*:*:*:*:python:*:*", "vulnerable": true, "matchCriteriaId": "4613D3BB-4C2B-4F02-9807-E42CFCB21525", "versionEndExcluding": "0.1.4"}, {"criteria": "cpe:2.3:a:nanobot:nanobot:0.1.4:-:*:*:*:python:*:*", "vulnerable": true, "matchCriteriaId": "E13C548B-00C2-4BC2-8B9D-71E446D00E22"}, {"criteria": "cpe:2.3:a:nanobot:nanobot:0.1.4:post1:*:*:*:python:*:*", "vulnerable": true, "matchCriteriaId": "F3EF840D-CFCC-4BED-B4A4-FEA25E642B79"}, {"criteria": "cpe:2.3:a:nanobot:nanobot:0.1.4:post2:*:*:*:python:*:*", "vulnerable": true, "matchCriteriaId": "96F3AEC6-D3E3-4A2B-A79E-EA44766FAAD9"}, {"criteria": "cpe:2.3:a:nanobot:nanobot:0.1.4:post3:*:*:*:python:*:*", "vulnerable": true, "matchCriteriaId": "CE228286-097D-4F2E-A8D7-DBF71197E50D"}, {"criteria": "cpe:2.3:a:nanobot:nanobot:0.1.4:post4:*:*:*:python:*:*", "vulnerable": true, "matchCriteriaId": "69C2B418-35C6-4F72-8355-018575BA8667"}, {"criteria": "cpe:2.3:a:nanobot:nanobot:0.1.4:post5:*:*:*:python:*:*", "vulnerable": true, "matchCriteriaId": "DC08A055-67E4-4752-A373-CCB966A863BD"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}