Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-19022

OpenHands send_pull_request.py initialize_repo command injection

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulDB

Description

A vulnerability was determined in OpenHands up to 0.62.0. The affected element is the function initialize_repo of the file OpenHands/resolver/send_pull_request.py. This manipulation causes command injection. Remote exploitation of the attack is possible. The vendor deleted the original GitHub issue report. It appears that the affected path/file got removed in version 1.7.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

n/a OpenHands

  • 0.1affected
  • 0.2affected
  • 0.3affected
  • 0.4affected
  • 0.5affected
  • 0.6affected
  • 0.7affected
  • 0.8affected
  • 0.9affected
  • 0.10affected
  • 0.11affected
  • 0.12affected
  • 0.13affected
  • 0.14affected
  • 0.15affected
  • 0.16affected
  • 0.17affected
  • 0.18affected
  • 0.19affected
  • 0.20affected
  • 0.21affected
  • 0.22affected
  • 0.23affected
  • 0.24affected
  • 0.25affected
  • 0.26affected
  • 0.27affected
  • 0.28affected
  • 0.29affected
  • 0.30affected
  • 0.31affected
  • 0.32affected
  • 0.33affected
  • 0.34affected
  • 0.35affected
  • 0.36affected
  • 0.37affected
  • 0.38affected
  • 0.39affected
  • 0.40affected
  • 0.41affected
  • 0.42affected
  • 0.43affected
  • 0.44affected
  • 0.45affected
  • 0.46affected
  • 0.47affected
  • 0.48affected
  • 0.49affected
  • 0.50affected
  • 0.51affected
  • 0.52affected
  • 0.53affected
  • 0.54affected
  • 0.55affected
  • 0.56affected
  • 0.57affected
  • 0.58affected
  • 0.59affected
  • 0.60affected
  • 0.61affected
  • 0.62.0affected

References