CVE-2026-35589 is a cross-site WebSocket hijacking flaw in the nanobot WhatsApp bridge, scored 8.0 (High) in the CVE record. A web page you visit can connect to the local bridge and act as your client. Versions before 0.1.5 are affected, and 0.1.5 fixes it.
What's affected
- Product: nanobot, the personal AI assistant, WhatsApp bridge component (npm package
nanobot-whatsapp-bridge) - Affected versions: before 0.1.5. The advisory lists "up to 0.1.4.post6"
- Fixed version: 0.1.5
- Vulnerable file:
bridge/src/server.ts
The flaw is an incomplete fix for CVE-2026-2577. That earlier change moved the bridge to listen on 127.0.0.1 and added an optional token, but the token is off by default and the server does not check the Origin header on the WebSocket handshake. The CVE is not in the CISA Known Exploited Vulnerabilities catalog.
How to check if you're exposed
Check the bridge version in the project's package.json or in the release you installed:
grep '"version"' bridge/package.json
Then check whether a BRIDGE_TOKEN is set in the environment that runs the bridge. If the token is not set and the version is below 0.1.5, any web page open in the browser of the machine running the bridge may be able to reach it.
What to do now
- Upgrade to nanobot 0.1.5 or later.
- Set a BRIDGE_TOKEN for the bridge, since token authentication is off unless you configure it.
- Do not browse untrusted sites in a browser on the machine that runs the bridge while you are on an old version.
- Review your linked WhatsApp devices and sign out any session you do not recognise.
- Check the 0.1.5 release notes for other changes that need action.
Why it matters
Browsers do not apply the same-origin policy to WebSocket connections unless the server refuses cross-origin ones. A server bound to localhost is still reachable from any page in the local browser. The record files this under CWE-1385, missing origin validation in WebSockets.
The advisory describes the impact as a hijack of the WhatsApp session. That means reading messages, capturing login state and sending messages as the user. For tools that bridge a personal messaging account to a local service, treating localhost as private is a common mistake. Require a secret by default, and check the origin of every handshake.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is binding to 127.0.0.1 enough?
No. A web page in your browser can still connect to a local WebSocket unless the server checks the origin or requires a token.
What should I set after upgrading?
Set a BRIDGE_TOKEN. The advisory says the token is disabled by default.
Sources
Last reviewed: 19 October 2026.
