A flaw in the OpenHuman agent allows an external sender who can message a Yuanbao channel to cause the agent to execute the node_exec tool without user approval. This occurs because the approval gate treats a missing approval context as non‑interactive, thereby granting execution rights to a write operation that is normally restricted. An attacker can run arbitrary JavaScript or operating‑system commands under the OpenHuman user account. The weakness is rooted in missing authorization (CWE‑862) and code injection (CWE‑94).

Any deployment of tinyhumansai:openhuman running a version older than 0.57.13 that utilizes a Yuanbao channel, operates under the default Supervised autonomy policy with Node enabled, and accepts external direct messages. The affected components are the agent turn request handling and the approval gate logic within the OpenHuman codebase.

The CVSS score of 9 indicates critical severity, and the EPSS score is not available, meaning the exploitation likelihood is uncertain. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a malicious user directly messaging the bot over the Yuanbao channel, triggering the node_exec command without prompting for approval. Given that the flaw permits arbitrary command execution, the potential impact to confidentiality, integrity, and availability is extensive, affecting all systems and data the OpenHuman user can access.