CVE-2026-55743

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-55743", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "state": "PUBLISHED", "assignerShortName": "TuranSec", "dateReserved": "2026-06-17T12:59:17.621Z", "datePublished": "2026-06-17T14:08:33.726Z", "dateUpdated": "2026-08-10T11:44:25.190Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T11:44:25.190Z"}, "title": "OpenHuman desktop agent shell tool sandbox bypass leads to arbitrary command execution", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-184", "description": "CWE-184 Incomplete List of Disallowed Inputs", "type": "CWE"}]}], "affected": [{"vendor": "tinyhumansai", "product": "OpenHuman", "platforms": ["macOS", "Windows", "Linux"], "collectionURL": "https://github.com/tinyhumansai/openhuman", "repo": "https://github.com/tinyhumansai/openhuman", "programFiles": ["src/openhuman/security/policy.rs"], "programRoutines": [{"name": "is_args_safe"}, {"name": "skip_env_assignments"}], "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "0.54.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The shell tool command allowlist in the SecurityPolicy of OpenHuman desktop agent through 0.54.0 (default Supervised security policy) can be bypassed to execute arbitrary OS commands with the privileges of the desktop user.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>The shell tool command allowlist in the SecurityPolicy of OpenHuman desktop agent through 0.54.0 (default Supervised security policy) can be bypassed to execute arbitrary OS commands with the privileges of the desktop user.</p>"}]}], "references": [{"url": "https://github.com/tinyhumansai/openhuman/commit/60050aa09a870f53ed7e4cd40ed41fd2860329e7", "name": "Fix commit (PR #2636): block find -execdir/-okdir", "tags": ["patch"]}, {"url": "https://github.com/tinyhumansai/openhuman/blob/v0.53.49-staging/src/openhuman/security/policy.rs", "name": "Vulnerable source at v0.53.49-staging: src/openhuman/security/policy.rs", "tags": ["technical-description"]}, {"url": "https://github.com/tinyhumansai/openhuman", "tags": ["product"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 9.6, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "CRITICAL", "baseScore": 9.4, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"}}], "credits": [{"lang": "en", "value": "Bobur Abdugafforov", "type": "finder"}, {"lang": "en", "value": "Zikrillayev Salohiddin", "type": "analyst"}], "source": {"discovery": "EXTERNAL"}, "datePublic": "2026-06-17T14:08:33.726Z"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-17T15:40:33.751475Z", "id": "CVE-2026-55743", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-17T15:40:47.796Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-55743", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-17T15:40:33.751475Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-17T15:40:42.467Z"}}], "cna": {"title": "OpenHuman desktop agent shell tool sandbox bypass leads to arbitrary command execution", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Bobur Abdugafforov"}, {"lang": "en", "type": "analyst", "value": "Zikrillayev Salohiddin"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.4, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/tinyhumansai/openhuman", "vendor": "tinyhumansai", "product": "OpenHuman", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "0.54.0"}], "platforms": ["macOS", "Windows", "Linux"], "programFiles": ["src/openhuman/security/policy.rs"], "collectionURL": "https://github.com/tinyhumansai/openhuman", "defaultStatus": "unaffected", "programRoutines": [{"name": "is_args_safe"}, {"name": "skip_env_assignments"}]}], "datePublic": "2026-06-17T14:08:33.726Z", "references": [{"url": "https://github.com/tinyhumansai/openhuman/commit/60050aa09a870f53ed7e4cd40ed41fd2860329e7", "name": "Fix commit (PR #2636): block find -execdir/-okdir", "tags": ["patch"]}, {"url": "https://github.com/tinyhumansai/openhuman/blob/v0.53.49-staging/src/openhuman/security/policy.rs", "name": "Vulnerable source at v0.53.49-staging: src/openhuman/security/policy.rs", "tags": ["technical-description"]}, {"url": "https://github.com/tinyhumansai/openhuman", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "The shell tool command allowlist in the SecurityPolicy of OpenHuman desktop agent through 0.54.0 (default Supervised security policy) can be bypassed to execute arbitrary OS commands with the privileges of the desktop user.", "supportingMedia": [{"type": "text/html", "value": "<p>The shell tool command allowlist in the SecurityPolicy of OpenHuman desktop agent through 0.54.0 (default Supervised security policy) can be bypassed to execute arbitrary OS commands with the privileges of the desktop user.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-184", "description": "CWE-184 Incomplete List of Disallowed Inputs"}]}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T11:44:25.190Z"}}}, "cveMetadata": {"cveId": "CVE-2026-55743", "state": "PUBLISHED", "dateUpdated": "2026-08-10T11:44:25.190Z", "dateReserved": "2026-06-17T12:59:17.621Z", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "datePublished": "2026-06-17T14:08:33.726Z", "assignerShortName": "TuranSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/tinyhumansai/openhuman", "defaultStatus": "unaffected", "platforms": ["macOS", "Windows", "Linux"], "product": "OpenHuman", "programFiles": ["src/openhuman/security/policy.rs"], "programRoutines": [{"name": "is_args_safe"}, {"name": "skip_env_assignments"}], "repo": "https://github.com/tinyhumansai/openhuman", "vendor": "tinyhumansai", "versions": [{"lessThanOrEqual": "0.54.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The shell tool command allowlist in the SecurityPolicy of OpenHuman desktop agent through 0.54.0 (default Supervised security policy) can be bypassed to execute arbitrary OS commands with the privileges of the desktop user."}, {"lang": "es", "value": "La lista de permitidos de comandos de herramientas de shell en la SecurityPolicy del agente de escritorio de OpenHuman hasta la versi\u00f3n 0.54.0 (pol\u00edtica de seguridad supervisada predeterminada) puede ser eludida para ejecutar comandos arbitrarios del sistema operativo con los privilegios del usuario de escritorio. Dos fallos en src/openhuman/security/policy.rs se combinan: (1) is_args_safe() bloquea las banderas de find -exec y -ok, pero no las funcionalmente id\u00e9nticas -execdir y -okdir, que tambi\u00e9n ejecutan un comando arbitrario para cada archivo coincidente; y (2) skip_env_assignments() elimina las asignaciones de variables de entorno KEY=value en l\u00ednea iniciales antes de la validaci\u00f3n de la lista de permitidos, por lo que un comando como GIT_EXTERNAL_DIFF=[cmd] git diff se valida como el git diff permitido pero, cuando se ejecuta a trav\u00e9s del shell, ejecuta [cmd] a trav\u00e9s de los hooks de git impulsados por el entorno (por ejemplo, GIT_EXTERNAL_DIFF o GIT_SSH_COMMAND). Debido a que el sandbox es el l\u00edmite de confianza principal entre el contenido no confiable procesado por LLM y el sistema operativo anfitri\u00f3n, un atacante puede lograr la ejecuci\u00f3n remota de c\u00f3digo a trav\u00e9s de la inyecci\u00f3n indirecta de prompt: un documento, correo electr\u00f3nico, evento de calendario o p\u00e1gina web maliciosos ingeridos por el agente le instruyen para que ejecute un comando de la lista de permitidos de apariencia benigna, lo que resulta en la ejecuci\u00f3n arbitraria de comandos, exfiltraci\u00f3n de datos, lectura/escritura arbitraria de archivos y movimiento lateral en la m\u00e1quina del usuario. El problema se solucion\u00f3 en el commit 60050aa09a870f53ed7e4cd40ed41fd2860329e7 (lanzado por primera vez en 0.54.22-staging; primera versi\u00f3n estable 0.56.0), que bloquea -execdir/-okdir para find."}], "id": "CVE-2026-55743", "lastModified": "2026-10-26T11:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 6.0, "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55743", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-06-17T15:40:33.751475Z", "version": "2.0.3"}}]}, "published": "2026-06-17T15:17:02.337", "references": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "url": "https://github.com/tinyhumansai/openhuman"}, {"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "url": "https://github.com/tinyhumansai/openhuman/blob/v0.53.49-staging/src/openhuman/security/policy.rs"}, {"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "url": "https://github.com/tinyhumansai/openhuman/commit/60050aa09a870f53ed7e4cd40ed41fd2860329e7"}], "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}, {"lang": "en", "value": "CWE-184"}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["macos", "windows", "linux"], "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.54.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "OpenHuman", "source": "cna", "vendor": "tinyhumansai"}, "product": "openhuman", "vendor": "tinyhumansai"}], "created": "2026-06-18T20:15:04.168979+00:00", "updated": "2026-08-10T23:45:04.653133+00:00", "vendors": ["tinyhumansai", "tinyhumansai$PRODUCT$openhuman"]}