PT-2026-32960 · Nanobot · Nanobot

Ylchen-007 · Published 2026-04-14 · Updated 2026-04-16 · CVE-2026-35589

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions nanobot versions prior to 0.1.5

Description A Cross-Site WebSocket Hijacking (CSWSH) issue exists in the bridge's WebSocket server within bridge/src/server.ts. The server does not validate the Origin header during the WebSocket handshake, and token authentication via the BRIDGE TOKEN parameter is disabled by default. Since browsers do not enforce the Same-Origin Policy on WebSockets unless the server explicitly denies cross-origin connections, any website visited by a user can establish a connection to the endpoint 'ws://127.0.0.1:3001/'. This allows an attacker to gain full access to the bridge API, hijack the WhatsApp session, read incoming messages, steal authentication QR codes, and send messages on behalf of the user.

Recommendations Update to version 0.1.5.

Exploit

Fix

Weakness Enumeration

CWE-1385

Related Identifiers

CVE-2026-35589

Affected Products

Nanobot

References · 6

• 🔥 https://github.com/HKUDS/nanobot/security/advisories/GHSA-v5j3-4q66-58cf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-35589 · Security Note
• https://github.com/HKUDS/nanobot/releases/tag/v0.1.5 · Note
• https://twitter.com/integ_sec/status/2044771179748114808 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2044226185895293178 · Twitter Post
• https://twitter.com/CVEnew/status/2044338888857317581 · Twitter Post