The get_git_diff() method in OpenHands copies a path parameter directly into a shell command without proper sanitization. A crafted value sent to the /api/conversations/{conversation_id}/git/diff endpoint enables an authenticated attacker to inject and execute arbitrary operating‑system commands, but only with the privileges granted to the agent sandbox.

This vulnerability affects the OpenHands product. Any release before version 1.5.0 runs the vulnerable code; version 1.5.0 and later contain the fix and should be deployed. The issue resides in the git diff functionality exposed through the OpenHands API.

The CVSS score of 7.6 classifies the flaw as high severity. EPSS indicates a probability of exploitation of less than 1 %, suggesting limited current activity. It is not listed in the CISA KEV catalog, so no documented wild exploitation. Exploitation requires that the attacker authenticate to the API and invoke the git diff endpoint, making it conditional on compromised credentials or inadequate access control.