EUVD-2026-53834
GHSA-f5cw-432q-pfqr
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable command injection requiring low-privilege authentication; scope unchanged and C/I/A capped at Low, consistent with the 4.0 vector's VC:L/VI:L/VA:L and no subsequent-system impact.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was determined in OpenHands up to 0.62.0. The affected element is the function initialize_repo of the file OpenHands/resolver/send_pull_request.py. This manipulation causes command injection. Remote exploitation of the attack is possible. The vendor deleted the original GitHub issue report. It appears that the affected path/file got removed in version 1.7.0.
AnalysisAI
Command injection in OpenHands versions up to 0.62.0 allows authenticated remote attackers to execute arbitrary OS commands by manipulating inputs processed by the initialize_repo function within the pull request resolver workflow. The vulnerable file OpenHands/resolver/send_pull_request.py was entirely removed in version 1.7.0, suggesting the fix is architectural rather than a targeted patch. No public exploit has been identified at time of analysis, though the vendor's deletion of the original GitHub issue report is a notable transparency concern; no CISA KEV listing exists.
Technical ContextAI
OpenHands is an AI-driven software development agent platform that can autonomously interact with code repositories, including creating and sending pull requests. The vulnerable component is the initialize_repo function in OpenHands/resolver/send_pull_request.py, which performs repository initialization as part of the pull request dispatch pipeline. CWE-74 (Injection) identifies the root cause class: the function incorporates externally-influenced input into a command or interpreted context without adequate neutralization of special characters or metacharacters, enabling an attacker to break out of the intended command structure. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms the function is reachable over the network with low attack complexity and no special attack preconditions beyond low-privilege authentication. No CPE string was provided in source data.
RemediationAI
The primary remediation is to upgrade OpenHands to version 1.7.0 or later, in which the affected file OpenHands/resolver/send_pull_request.py and its initialize_repo function were removed, eliminating the vulnerable code path entirely. The GitHub repository is at https://github.com/OpenHands/OpenHands/. No official vendor advisory URL is available - the original GitHub issue (https://github.com/OpenHands/OpenHands/issues/14903) was deleted by the vendor, and VulDB (https://vuldb.com/vuln/386426) is the primary disclosure reference. If an immediate upgrade to 1.7.0 is not feasible, restrict access to the OpenHands instance so that only fully trusted, vetted users can authenticate and invoke pull request resolver workflows, since the exploit path requires authenticated access to that workflow. Additionally, monitor application logs for unexpected subprocess invocations or shell command executions originating from the resolver component as a detection compensating control.
Same technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today