Zikrillayev Salohiddin

**Name of the Vulnerable Software and Affected Versions** OpenHuman desktop agent versions prior to 0.56.0 **Description** The shell tool command allowlist in the SecurityPolicy can be bypassed to execute arbitrary OS commands with the privileges of the desktop user. This occurs due to two flaws in `src/openhuman/security/policy.rs`: the `is args safe()` function fails to block the `-execdir` and `-okdir` flags for the find command, and the `skip env assignments()` function strips leading inline environment-variable assignments before allowlist validation. This allows commands like `GIT EXTERNAL DIFF=<cmd> git diff` to be validated as allowed while executing arbitrary commands through environment-driven hooks such as `GIT EXTERNAL DIFF` or `GIT SSH COMMAND`. An attacker can achieve remote code execution via indirect prompt injection, where malicious content ingested by the agent triggers an allowlisted command to perform unauthorized actions, including data exfiltration and lateral movement. **Recommendations** Update to version 0.56.0 or later.