Why it matters
nanobot is an agent framework whose shell-execution guardrail is the primary control preventing an LLM-directed command from escaping into unintended host operations; both flaws erode that boundary from different angles (argument smuggling and denylist gaps).
Attack vector
ExecTool._guard_command/_spawn in nanobot/agent/tools/shell.py is subject to argument injection (CVE-2026-90809, CVSS 7.3) and a related incomplete-blacklist bypass in the same guard function (CVE-2026-90808, CVSS 6.3) letting crafted arguments evade the shell-command allow/deny checks.
Affected systems
HKUDS nanobot up to 0.2.1
Mitigation
Track the nanobot GitHub repository for a fix; restrict which shell commands the agent's ExecTool is permitted to invoke and validate arguments independently of the built-in guard.