What’s Vulnerable › Vulnerabilities

CVE-2026-55743: OpenHuman desktop agent shell tool sandbox bypass leads to arbitrary command execution

• Severity: critical (CVSS 9.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-17 · updated 2026-10-26
• Weakness: CWE-78

Description

The shell tool command allowlist in the SecurityPolicy of OpenHuman desktop agent through 0.54.0 (default Supervised security policy) can be bypassed to execute arbitrary OS commands with the privileges of the desktop user.

Affected products

• tinyhumansai OpenHuman: through 0.54.0

References

• https://github.com/tinyhumansai/openhuman
• https://github.com/tinyhumansai/openhuman/blob/v0.53.49-staging/src/openhuman/security/policy.rs
• https://github.com/tinyhumansai/openhuman/commit/60050aa09a870f53ed7e4cd40ed41fd2860329e7

Get alerted when CVE-2026-55743 or the next vulnerability affects your stack