Summary
Nanobot wrote tool output verbatim to stdout. An adversarial tool could include ANSI escape codes or terminal control sequences in its output, manipulating the terminal display of the developer running the agent. Cosmetic but in some terminals could obscure security warnings. Fixed by sanitising tool output before logging.
Details
| CVE ID | CVE-2026-23501 |
| Severity | low (3.7) |
| CVSS vector | AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N |
| Published | 2026-03-29 |
| Patched | 2026-04-01 |
| Affected versions | 0.1.0 – 0.6.x |
| Fixed in | 0.7.0 |
| Exploited in the wild | no known exploitation |
Affected projects
What to do
- If you run an affected version: upgrade to
0.7.0immediately. Do not delay this for convenience reasons. - Rotate any credentials that may have been exposed via the affected component.
- Audit your logs for indicators of exploitation — unexpected outbound traffic, anomalous tool calls, unfamiliar authenticated sessions.
- If exploitation is confirmed, treat the host as compromised: rebuild from a clean image, rotate every secret on the host, audit lateral movement.
Sources
- NIST NVD: CVE-2026-23501 on NVD
See also: all CVEs, tracked agents, methodology.