CVE-2026-35589

CVE-2026-35589 is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability affecting nanobot, a personal AI assistant, in versions prior to 0.1.5. The vulnerability exists in the WebSocket server component located in bridge/src/server.ts and stems from an incomplete remediation of a previous vulnerability. An attacker can exploit this flaw by having a user visit a malicious website while running the bridge service, allowing the website to establish an unauthorized WebSocket connection and gain full access to the bridge API. The vulnerability carries a CVSS score of 8.0 (HIGH) with a network attack vector, high complexity, and no privilege requirements. Exploitation requires user interaction (UI:R) but affects the confidentiality and integrity of the affected system. The root cause is the failure to validate the Origin header during WebSocket handshake and the default-disabled token authentication mechanism. Successful exploitation enables attackers to hijack WhatsApp sessions, intercept incoming messages, steal authentication QR codes, and send unauthorized messages on behalf of the compromised user. There is currently no evidence of active exploitation, with the vulnerability absent from the Known Exploited Vulnerabilities (KEV) catalog and inactive on vulnerability hot lists. The EPSS score of 0.00021 indicates minimal historical exploitation probability. The vulnerability has been remediated in version 0.1.5, and organizations running nanobot should prioritize updating to this patched version to mitigate the risk.