The vulnerability lies in the Telegram connector’s username allowlist, which authorizes senders based on a mutable username instead of their immutable numeric identifier. An attacker can register a username that matches an entry in the allowFrom list and submit turns to the workspace agent, causing the agent to run configured tools on the operator’s machine. This effectively enables the attacker to trigger arbitrary code execution on that machine.

Devices running holaboss‑ai’s holaOS up to and including version 2026.822.1 that deploy the channel‑gateway Telegram connector are affected. The flaw is present in the source file connectors/telegram.ts and is referenced in the cited GitHub commit.

The CVSS score of 6.3 indicates moderate to high severity, while no EPSS data is currently available and the vulnerability is not listed in CISA KEV. Exploitation can occur remotely via the Telegram platform; an attacker only needs to register a username that the system will accept as part of the allowlist. Because the workspace agent can execute arbitrary tools, the impact could rise to full code execution on the operator’s workstation.