CVE-2026-33654: nanobot indirect prompt injection through email channel processing

Summary

CVE-2026-33654 affects nanobot, a personal AI assistant, prior to version 0.1.6. An indirect prompt injection flaw in the email channel processing module (`nanobot/channels/email.py`) lets a remote, unauthenticated attacker run arbitrary LLM instructions, and then system tools, by sending an email to the bot's monitored address. The bot polls and processes that content as highly trusted input, bypassing channel isolation, so the attack needs no action from the bot owner.

Mitigation

Version 0.1.6 patches the issue. Upgrade to 0.1.6 or later.

Topics

• Prompt injection and jailbreaks

Related items

• LowCVE-2026-123498: Vikunja veans prompt injection through project titles and task contentSimilar attack · NVD/CVE Database
• MediumCVE-2026-124028: mistral.rs delimiter injection allows attacker-chosen tool calls via quoted textSimilar attack · NVD/CVE Database
• MediumCVE-2026-123851: JetBrains Junie GitHub Action prompt injection bypass via HTML encodingSimilar attack · NVD/CVE Database
• InfoDecision Models as Retrieval Gates Against Injection and PollutionSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoMultimodal-SEA: Benchmarking AI Agent Security under Multimodal Social Engineering AttacksSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)