nanobot 0.1.4 Post 1 for Python

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:nanobot:nanobot:0.1.4:post1:*:*:*:python:*:*

part: a version: 0.1.4 update: post1

VendorNanobot (2ababca4-61ea-5e1d-8722-4822bb8f2139)
ProductNanobot (6556255a-8330-5582-9c0f-45baaccd1a0d)
Edition*
Language*
Software edition*
Target softwarepython
Target hardware*
Other*

Notes

Imported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-33654 vulnerable 2026-06-08 07:59:10.540515 Zero-Click Indirect Prompt Injection and Authentication Bypass via Email Polling
nanobot is a personal AI assistant. Prior to version 0.1.6, an indirect prompt injection vulnerability exists in the email channel processing module (`nanobot/channels/email.py`), allowing a remote, unauthenticated attacker to execute arbitrary LLM instructions (and subsequently, system tools) without any interaction from the bot owner. By sending an email containing malicious prompts to the bot's monitored email address, the bot automatically polls, ingests, and processes the email content as highly trusted input, fully bypassing channel isolation and resulting in a stealthy, zero-click attack. Version 0.1.6 patches the issue.
Published: 2026-03-27T19:43:49.193Z
Updated: 2026-03-30T18:59:48.689Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.