Openhuman
Monthly
Sandbox-escape command injection in the tinyhumansai OpenHuman desktop agent (through version 0.54.0) lets attacker-controlled content trick the agent into running arbitrary OS commands as the desktop user despite the default Supervised allowlist. Two allowlist-bypass flaws in src/openhuman/security/policy.rs are combined via indirect prompt injection: find's -execdir/-okdir flags (unlike the blocked -exec/-ok) still run per-file commands, and leading inline env-var assignments (e.g. GIT_EXTERNAL_DIFF=<cmd> git diff) are stripped before validation but honored at shell execution. No public exploit identified at time of analysis and it is not on CISA KEV (SSVC exploitation: none), but the mechanism is fully documented in the advisory and fix commit, and EPSS is modest at 0.70%.
Sandbox-escape command injection in the tinyhumansai OpenHuman desktop agent (through version 0.54.0) lets attacker-controlled content trick the agent into running arbitrary OS commands as the desktop user despite the default Supervised allowlist. Two allowlist-bypass flaws in src/openhuman/security/policy.rs are combined via indirect prompt injection: find's -execdir/-okdir flags (unlike the blocked -exec/-ok) still run per-file commands, and leading inline env-var assignments (e.g. GIT_EXTERNAL_DIFF=<cmd> git diff) are stripped before validation but honored at shell execution. No public exploit identified at time of analysis and it is not on CISA KEV (SSVC exploitation: none), but the mechanism is fully documented in the advisory and fix commit, and EPSS is modest at 0.70%.