CVE-2026-19022

Thursday, August 06, 2026

5.3

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X

Summary

A vulnerability was determined in OpenHands up to 0.62.0. The affected element is the function initialize_repo of the file OpenHands/resolver/send_pull_request.py. This manipulation causes command injection. Remote exploitation of the attack is possible. The vendor deleted the original GitHub issue report. It appears that the affected path/file got removed in version 1.7.0.

Affected Software

Vendor	Product	Version Range	Status
n/a	OpenHands	`0.1`	affected
n/a	OpenHands	`0.2`	affected
n/a	OpenHands	`0.3`	affected
n/a	OpenHands	`0.4`	affected
n/a	OpenHands	`0.5`	affected
n/a	OpenHands	`0.6`	affected
n/a	OpenHands	`0.7`	affected
n/a	OpenHands	`0.8`	affected
n/a	OpenHands	`0.9`	affected
n/a	OpenHands	`0.10`	affected
n/a	OpenHands	`0.11`	affected
n/a	OpenHands	`0.12`	affected
n/a	OpenHands	`0.13`	affected
n/a	OpenHands	`0.14`	affected
n/a	OpenHands	`0.15`	affected
n/a	OpenHands	`0.16`	affected
n/a	OpenHands	`0.17`	affected
n/a	OpenHands	`0.18`	affected
n/a	OpenHands	`0.19`	affected
n/a	OpenHands	`0.20`	affected
n/a	OpenHands	`0.21`	affected
n/a	OpenHands	`0.22`	affected
n/a	OpenHands	`0.23`	affected
n/a	OpenHands	`0.24`	affected
n/a	OpenHands	`0.25`	affected
n/a	OpenHands	`0.26`	affected
n/a	OpenHands	`0.27`	affected
n/a	OpenHands	`0.28`	affected
n/a	OpenHands	`0.29`	affected
n/a	OpenHands	`0.30`	affected
n/a	OpenHands	`0.31`	affected
n/a	OpenHands	`0.32`	affected
n/a	OpenHands	`0.33`	affected
n/a	OpenHands	`0.34`	affected
n/a	OpenHands	`0.35`	affected
n/a	OpenHands	`0.36`	affected
n/a	OpenHands	`0.37`	affected
n/a	OpenHands	`0.38`	affected
n/a	OpenHands	`0.39`	affected
n/a	OpenHands	`0.40`	affected
n/a	OpenHands	`0.41`	affected
n/a	OpenHands	`0.42`	affected
n/a	OpenHands	`0.43`	affected
n/a	OpenHands	`0.44`	affected
n/a	OpenHands	`0.45`	affected
n/a	OpenHands	`0.46`	affected
n/a	OpenHands	`0.47`	affected
n/a	OpenHands	`0.48`	affected
n/a	OpenHands	`0.49`	affected
n/a	OpenHands	`0.50`	affected
n/a	OpenHands	`0.51`	affected
n/a	OpenHands	`0.52`	affected
n/a	OpenHands	`0.53`	affected
n/a	OpenHands	`0.54`	affected
n/a	OpenHands	`0.55`	affected
n/a	OpenHands	`0.56`	affected
n/a	OpenHands	`0.57`	affected
n/a	OpenHands	`0.58`	affected
n/a	OpenHands	`0.59`	affected
n/a	OpenHands	`0.60`	affected
n/a	OpenHands	`0.61`	affected
n/a	OpenHands	`0.62.0`	affected

Weaknesses

CWE-77: Command Injection
CWE-74: Injection

ADP Enrichment

CISA ADP Vulnrichment

SSVC:
Exploitation: poc
- Automatable: no
- Technical Impact: partial

Additional References

https://vuldb.com/submit/863529

References

Feedback

Was this page helpful?

Glad to hear it! Please tell us how we can improve.

Sorry to hear that. Please tell us how we can improve.