{"id":"CVE-2026-55743","state":"PUBLISHED","title":"OpenHuman desktop agent shell tool sandbox bypass leads to arbitrary command execution","description":"The shell tool command allowlist in the SecurityPolicy of OpenHuman desktop agent through 0.54.0 (default Supervised security policy) can be bypassed to execute arbitrary OS commands with the privileges of the desktop user.","publishedAt":"2026-06-17T14:08:33.726Z","updatedAt":"2026-08-10T11:44:25.190Z","severity":{"score":9.4,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","source":"TuranSec"},"assigner":"TuranSec","products":["tinyhumansai OpenHuman"],"affected":[{"vendor":"tinyhumansai","product":"OpenHuman","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"0.54.0","versionType":"semver"}],"platforms":["macOS","Windows","Linux"],"collectionURL":"https://github.com/tinyhumansai/openhuman","repo":"https://github.com/tinyhumansai/openhuman","programFiles":["src/openhuman/security/policy.rs"],"programRoutines":[{"name":"is_args_safe"},{"name":"skip_env_assignments"}]}],"references":["https://github.com/tinyhumansai/openhuman/commit/60050aa09a870f53ed7e4cd40ed41fd2860329e7","https://github.com/tinyhumansai/openhuman/blob/v0.53.49-staging/src/openhuman/security/policy.rs","https://github.com/tinyhumansai/openhuman"],"weaknesses":["CWE-78","CWE-184"],"ingestedAt":"2026-10-29T20:12:24.861Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/55xxx/CVE-2026-55743.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-55743","state":"PUBLISHED","datePublished":"2026-06-17T14:08:33.726Z","dateUpdated":"2026-08-10T11:44:25.190Z","assignerShortName":"TuranSec","assignerOrgId":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","dateReserved":"2026-06-17T12:59:17.621Z"},"containers":{"cna":{"title":"OpenHuman desktop agent shell tool sandbox bypass leads to arbitrary command execution","descriptions":[{"lang":"en","value":"The shell tool command allowlist in the SecurityPolicy of OpenHuman desktop agent through 0.54.0 (default Supervised security policy) can be bypassed to execute arbitrary OS commands with the privileges of the desktop user."}],"affected":[{"vendor":"tinyhumansai","product":"OpenHuman","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"0.54.0","versionType":"semver"}],"platforms":["macOS","Windows","Linux"],"collectionURL":"https://github.com/tinyhumansai/openhuman","repo":"https://github.com/tinyhumansai/openhuman","programFiles":["src/openhuman/security/policy.rs"],"programRoutines":[{"name":"is_args_safe"},{"name":"skip_env_assignments"}]}],"references":[{"url":"https://github.com/tinyhumansai/openhuman/commit/60050aa09a870f53ed7e4cd40ed41fd2860329e7","name":"Fix commit (PR #2636): block find -execdir/-okdir","tags":["patch"]},{"url":"https://github.com/tinyhumansai/openhuman/blob/v0.53.49-staging/src/openhuman/security/policy.rs","name":"Vulnerable source at v0.53.49-staging: src/openhuman/security/policy.rs","tags":["technical-description"]},{"url":"https://github.com/tinyhumansai/openhuman","tags":["product"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseSeverity":"CRITICAL","baseScore":9.6,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"}},{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"CRITICAL","baseScore":9.4,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","lang":"en","description":"CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-184","lang":"en","description":"CWE-184 Incomplete List of Disallowed Inputs","type":"CWE"}]}],"providerMetadata":{"shortName":"TuranSec","orgId":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","dateUpdated":"2026-08-10T11:44:25.190Z"},"credits":[{"lang":"en","value":"Bobur Abdugafforov","type":"finder"},{"lang":"en","value":"Zikrillayev Salohiddin","type":"analyst"}],"source":{"discovery":"EXTERNAL"},"datePublic":"2026-06-17T14:08:33.726Z"},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-06-17T15:40:33.751475Z","id":"CVE-2026-55743","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-06-17T15:40:47.796Z"}}]}}}