Description
The shell tool command allowlist in the SecurityPolicy of OpenHuman desktop agent through 0.54.0 (default Supervised security policy) can be bypassed to execute arbitrary OS commands with the privileges of the desktop user.
Published: 2026-06-17
Score: 9.4 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in the shell tool command allowlist of the OpenHuman desktop agent's SecurityPolicy, allowing a bypass that results in arbitrary OS command execution with the privileges of the desktop user. This flaw is a Command Injection issue involving CWE-184 and CWE-78. An attacker who can supply a malicious command string to the agent can execute any system command.

Affected Systems

The affected product is the OpenHuman desktop agent from tinyhumansai. Versions up to and including 0.54.0, which use the default Supervised security policy, are vulnerable. It is unclear whether later releases are still affected until an official fix is released.

Risk and Exploitability

The CVSS score of 9.4 marks a high severity remote code execution. EPSS indicates a low exploitation probability (<1%), and it is not listed in CISA's KEV catalog. Based on the description, the attack requires the agent to process a malicious input that defeats the allowlist, giving an attacker full command execution on the user’s machine.

Generated by OpenCVE AI on August 10, 2026 at 23:44 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any available vendor patch or upgrade the OpenHuman desktop agent to a version that includes the SecurityPolicy fix.
  • Disable or tightly restrict the agent’s processing of untrusted input, such as email attachments, documents, or external triggers.
  • Run the agent under the least privilege possible to limit the damage of potential command execution.

Generated by OpenCVE AI on August 10, 2026 at 23:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 10 Aug 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 10 Aug 2026 12:00:00 +0000

Type Values Removed Values Added
Description The shell tool command allowlist in the SecurityPolicy of OpenHuman desktop agent through 0.54.0 (default Supervised security policy) can be bypassed to execute arbitrary OS commands with the privileges of the desktop user. Two flaws in src/openhuman/security/policy.rs combine: (1) is_args_safe() blocks the find flags -exec and -ok but not the functionally identical -execdir and -okdir, which also execute an arbitrary command for each matched file; and (2) skip_env_assignments() strips leading inline KEY=value environment-variable assignments before allowlist validation, so a command such as GIT_EXTERNAL_DIFF=<cmd> git diff is validated as the allowed git diff but, when executed via the shell, runs <cmd> through git's environment-driven hooks (for example GIT_EXTERNAL_DIFF or GIT_SSH_COMMAND). Because the sandbox is the primary trust boundary between untrusted LLM-processed content and the host operating system, an attacker can achieve remote code execution via indirect prompt injection: a malicious document, email, calendar event, or web page ingested by the agent instructs it to run a benign-looking allowlisted command, resulting in arbitrary command execution, data exfiltration, arbitrary file read/write, and lateral movement on the user's machine. The issue was fixed in commit 60050aa09a870f53ed7e4cd40ed41fd2860329e7 (first released in 0.54.22-staging; first stable release 0.56.0), which blocks -execdir/-okdir for find. The shell tool command allowlist in the SecurityPolicy of OpenHuman desktop agent through 0.54.0 (default Supervised security policy) can be bypassed to execute arbitrary OS commands with the privileges of the desktop user.
Title OpenHuman Desktop Agent - Shell Tool Sandbox Bypass Leads to Arbitrary Command Execution OpenHuman desktop agent shell tool sandbox bypass leads to arbitrary command execution

Mon, 10 Aug 2026 11:45:00 +0000

Type Values Removed Values Added
Title OpenHuman desktop agent shell tool sandbox bypass leads to arbitrary command execution OpenHuman Desktop Agent - Shell Tool Sandbox Bypass Leads to Arbitrary Command Execution

Sun, 21 Jun 2026 09:45:00 +0000

Type Values Removed Values Added
First Time appeared Tinyhumansai
Tinyhumansai openhuman
Vendors & Products Tinyhumansai
Tinyhumansai openhuman

Thu, 18 Jun 2026 04:45:00 +0000

Type Values Removed Values Added
Description The shell tool command allowlist in the SecurityPolicy of OpenHuman desktop agent through 0.54.0 (default Supervised security policy) can be bypassed to execute arbitrary OS commands with the privileges of the desktop user. Two flaws in src/openhuman/security/policy.rs combine: (1) is_args_safe() blocks the find flags -exec and -ok but not the functionally identical -execdir and -okdir, which also execute an arbitrary command for each matched file; and (2) skip_env_assignments() strips leading inline KEY=value environment-variable assignments before allowlist validation, so a command such as GIT_EXTERNAL_DIFF=<cmd> git diff is validated as the allowed git diff but, when executed via the shell, runs <cmd> through git's environment-driven hooks (for example GIT_EXTERNAL_DIFF or GIT_SSH_COMMAND). Because the sandbox is the primary trust boundary between untrusted LLM-processed content and the host operating system, an attacker can achieve remote code execution via indirect prompt injection: a malicious document, email, calendar event, or web page ingested by the agent instructs it to run a benign-looking allowlisted command, resulting in arbitrary command execution, data exfiltration, arbitrary file read/write, and lateral movement on the user's machine. The issue was fixed in commit 60050aa09a870f53ed7e4cd40ed41fd2860329e7 (first released in 0.54.22-staging; first stable release 0.56.0), which blocks -execdir/-okdir for find.
Title OpenHuman desktop agent shell tool sandbox bypass leads to arbitrary command execution
Weaknesses CWE-184
CWE-78
References
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

Subscriptions

Tinyhumansai Openhuman
cve-icon MITRE

Status: PUBLISHED

Assigner: TuranSec

Published:

Updated: 2026-08-10T11:44:25.190Z

Reserved: 2026-06-17T12:59:17.621Z

Link: CVE-2026-55743

cve-icon Vulnrichment

Updated: 2026-06-17T15:40:42.467Z

cve-icon NVD

Status : Deferred

Published: 2026-06-17T15:17:02.337

Modified: 2026-08-10T12:17:18.963

Link: CVE-2026-55743

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-10T23:45:04Z

Weaknesses
  • CWE-184

    Incomplete List of Disallowed Inputs

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')