CVE-2026-33654 is an indirect prompt injection flaw in the email channel of nanobot, a personal AI assistant. NVD scores it 9.8. Anyone who can email the bot's inbox can feed instructions to the model. Upgrade nanobot past the affected versions.
What's affected
The NVD record says versions prior to 0.1.6 are affected. The GitHub advisory, which covers the pip package, lists affected versions as 0.1.4.post5 and below and the first patched version as 0.1.4.post6. The two sources draw the line differently, so choose the newest release, which is at or above both.
Only setups that use the email channel are in scope. The vulnerable code is in nanobot/channels/email.py, which polls an IMAP mailbox for new messages.
How to check if you're exposed
List the installed version:
pip show nanobot
Then check whether the email channel is enabled in your configuration. If the bot polls an IMAP mailbox, it reads messages from anyone who can send to that address. A bot that only uses other channels does not use the vulnerable path.
Also look at what tools the assistant can call. The advisory says the attacker's instructions can reach system tools, so the blast radius equals the bot's permissions.
What to do now
- Upgrade nanobot to the latest release, and at minimum to 0.1.6 or later as NVD describes.
- Review the tools and system permissions the assistant has, and remove any it does not need.
- Use a mailbox the bot reads that only accepts mail from addresses you control, and make sure your mail provider enforces sender authentication.
- Check the mailbox and the bot's logs for unexpected messages received before the upgrade.
Why it matters
The record lists CWE-1336, CWE-290 and CWE-94. The central one is 290, authentication bypass by spoofing. The advisory says the sender identity was read from the From header of the raw email, which anyone can set to any value, and was then trusted as who the sender was.
Once a message is treated as coming from the owner, its text is processed as trusted input. That is how an email turns into model instructions with no click from the owner. Prompt injection, where text in data is read as a command, is hard to filter out. Verifying who sent the data and limiting what the agent may do are stronger controls.
Any assistant that reads untrusted content and holds tool access has this shape of risk. The record is not marked as exploited in the wild and is not in CISA KEV.
Quick check
Can I fix this by filtering words in emails?
Filtering is weak against prompt injection. The advisory fix is in how the sender is identified, and you should also limit the tools the bot can use.
Sources
Last reviewed: 19 October 2026.
