CVE-2026-55743

Name of the Vulnerable Software and Affected Versions OpenHuman desktop agent versions prior to 0.56.0

Description The shell tool command allowlist in the SecurityPolicy can be bypassed to execute arbitrary OS commands with the privileges of the desktop user. This occurs due to two flaws in src/openhuman/security/policy.rs: the is args safe() function fails to block the -execdir and -okdir flags for the find command, and the skip env assignments() function strips leading inline environment-variable assignments before allowlist validation. This allows commands like GIT EXTERNAL DIFF=<cmd> git diff to be validated as allowed while executing arbitrary commands through environment-driven hooks such as GIT EXTERNAL DIFF or GIT SSH COMMAND. An attacker can achieve remote code execution via indirect prompt injection, where malicious content ingested by the agent triggers an allowlisted command to perform unauthorized actions, including data exfiltration and lateral movement.

Recommendations Update to version 0.56.0 or later.