A Command Injection flaw resides in the get_git_diff() function that builds a shell command with the path supplied by the /api/conversations/{conversation_id}/git/diff endpoint. Unsanitized input allows an authenticated user to inject arbitrary shell commands, which then run inside the agent’s sandbox environment. The weakness is categorized as CWE‑78, a classic command execution vulnerability that bypasses the normal command‐execution controls of OpenHands.

The flaw exists in all OpenHands releases prior to version 1.5.0. The affected component is the git diff handler located in openhands/runtime/utils/git_handler.py, and the vulnerability is triggered by calls to the aforementioned API endpoint. Only users with valid authentication who can access that endpoint are able to exploit the issue.

The vulnerability carries a CVSS score of 7.6, indicating high severity. EPSS data is unavailable and the issue is not listed in the CISA KEV catalog. Exploitation requires authenticated access to the diff API; once invoked, the attacker can execute any shell command within the sandbox. While the compromise is confined to the sandbox, it can still lead to data exfiltration or privilege escalation if the sandbox has access to sensitive resources.