CVE-2026-55743

Summary

The shell tool command allowlist in the SecurityPolicy of OpenHuman desktop agent through 0.54.0 (default Supervised security policy) can be bypassed to execute arbitrary OS commands with the privileges of the desktop user.

Affected Software

Weaknesses

• CWE-78: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
• CWE-184: CWE-184 Incomplete List of Disallowed Inputs

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: total

References

• https://github.com/tinyhumansai/openhuman/commit/60050aa09a870f53ed7e4cd40ed41fd2860329e7
• https://github.com/tinyhumansai/openhuman/blob/v0.53.49-staging/src/openhuman/security/policy.rs
• https://github.com/tinyhumansai/openhuman

• ←Previous
• Next→