Vulnerability-Lookup

CVE-2026-33718 (GCVE-0-2026-33718)

Vulnerability from cvelistv5 – Published: 2026-03-27 00:12 – Updated: 2026-03-27 20:04

Title

OpenHands is Vulnerable to Command Injection through its Git Diff Handler

Summary

OpenHands is software for AI-driven development. Starting in version 1.5.0, a Command Injection vulnerability exists in the `get_git_diff()` method at `openhands/runtime/utils/git_handler.py:134`. The `path` parameter from the `/api/conversations/{conversation_id}/git/diff` API endpoint is passed unsanitized to a shell command, allowing authenticated attackers to execute arbitrary commands in the agent sandbox. The user is already allowed to instruct the agent to execute commands, but this bypasses the normal channels. Version 1.5.0 fixes the issue.

Severity ?

7.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/OpenHands/OpenHands/security/a…	x_refsource_CONFIRM
	https://github.com/OpenHands/OpenHands/pull/13051	x_refsource_MISC
	https://docs.python.org/3/library/shlex.html#shle…	x_refsource_MISC
	https://docs.python.org/3/library/subprocess.html…	x_refsource_MISC
	https://owasp.org/www-community/attacks/Command_I…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	OpenHands	OpenHands	Affected: < 1.5.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33718",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-27T20:04:41.208442Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-27T20:04:54.607Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OpenHands",
          "vendor": "OpenHands",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenHands is software for AI-driven development. Starting in version 1.5.0, a Command Injection vulnerability exists in the `get_git_diff()` method at `openhands/runtime/utils/git_handler.py:134`. The `path` parameter from the `/api/conversations/{conversation_id}/git/diff` API endpoint is passed unsanitized to a shell command, allowing authenticated attackers to execute arbitrary commands in the agent sandbox. The user is already allowed to instruct the agent to execute commands, but this bypasses the normal channels. Version 1.5.0 fixes the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-27T00:12:24.752Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/OpenHands/OpenHands/security/advisories/GHSA-7h8w-hj9j-8rjw",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/OpenHands/OpenHands/security/advisories/GHSA-7h8w-hj9j-8rjw"
        },
        {
          "name": "https://github.com/OpenHands/OpenHands/pull/13051",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/OpenHands/OpenHands/pull/13051"
        },
        {
          "name": "https://docs.python.org/3/library/shlex.html#shlex.quote",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.python.org/3/library/shlex.html#shlex.quote"
        },
        {
          "name": "https://docs.python.org/3/library/subprocess.html#security-considerations",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.python.org/3/library/subprocess.html#security-considerations"
        },
        {
          "name": "https://owasp.org/www-community/attacks/Command_Injection",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://owasp.org/www-community/attacks/Command_Injection"
        }
      ],
      "source": {
        "advisory": "GHSA-7h8w-hj9j-8rjw",
        "discovery": "UNKNOWN"
      },
      "title": "OpenHands is Vulnerable to Command Injection through its Git Diff Handler"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-33718",
    "datePublished": "2026-03-27T00:12:24.752Z",
    "dateReserved": "2026-03-23T17:06:05.749Z",
    "dateUpdated": "2026-03-27T20:04:54.607Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-33718\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-03-27T01:16:19.483\",\"lastModified\":\"2026-03-30T13:26:29.793\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"OpenHands is software for AI-driven development. Starting in version 1.5.0, a Command Injection vulnerability exists in the `get_git_diff()` method at `openhands/runtime/utils/git_handler.py:134`. The `path` parameter from the `/api/conversations/{conversation_id}/git/diff` API endpoint is passed unsanitized to a shell command, allowing authenticated attackers to execute arbitrary commands in the agent sandbox. The user is already allowed to instruct the agent to execute commands, but this bypasses the normal channels. Version 1.5.0 fixes the issue.\"},{\"lang\":\"es\",\"value\":\"OpenHands es un software para el desarrollo impulsado por IA. A partir de la versi\u00f3n 1.5.0, existe una vulnerabilidad de inyecci\u00f3n de comandos en el m\u00e9todo \u0027get_git_diff()\u0027 en \u0027openhands/runtime/utils/git_handler.py:134\u0027. El par\u00e1metro \u0027path\u0027 del endpoint de API \u0027/api/conversations/{conversation_id}/git/diff\u0027 se pasa sin sanear a un comando de shell, permitiendo a atacantes autenticados ejecutar comandos arbitrarios en el sandbox del agente. Al usuario ya se le permite instruir al agente para ejecutar comandos, pero esto elude los canales normales. La versi\u00f3n 1.5.0 corrige el problema.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L\",\"baseScore\":7.6,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.8,\"impactScore\":4.7}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-78\"}]}],\"references\":[{\"url\":\"https://docs.python.org/3/library/shlex.html#shlex.quote\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://docs.python.org/3/library/subprocess.html#security-considerations\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/OpenHands/OpenHands/pull/13051\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/OpenHands/OpenHands/security/advisories/GHSA-7h8w-hj9j-8rjw\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://owasp.org/www-community/attacks/Command_Injection\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-33718\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-27T20:04:41.208442Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-27T20:04:51.082Z\"}}], \"cna\": {\"title\": \"OpenHands is Vulnerable to Command Injection through its Git Diff Handler\", \"source\": {\"advisory\": \"GHSA-7h8w-hj9j-8rjw\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.6, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"OpenHands\", \"product\": \"OpenHands\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 1.5.0\"}]}], \"references\": [{\"url\": \"https://github.com/OpenHands/OpenHands/security/advisories/GHSA-7h8w-hj9j-8rjw\", \"name\": \"https://github.com/OpenHands/OpenHands/security/advisories/GHSA-7h8w-hj9j-8rjw\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/OpenHands/OpenHands/pull/13051\", \"name\": \"https://github.com/OpenHands/OpenHands/pull/13051\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://docs.python.org/3/library/shlex.html#shlex.quote\", \"name\": \"https://docs.python.org/3/library/shlex.html#shlex.quote\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://docs.python.org/3/library/subprocess.html#security-considerations\", \"name\": \"https://docs.python.org/3/library/subprocess.html#security-considerations\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://owasp.org/www-community/attacks/Command_Injection\", \"name\": \"https://owasp.org/www-community/attacks/Command_Injection\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"OpenHands is software for AI-driven development. Starting in version 1.5.0, a Command Injection vulnerability exists in the `get_git_diff()` method at `openhands/runtime/utils/git_handler.py:134`. The `path` parameter from the `/api/conversations/{conversation_id}/git/diff` API endpoint is passed unsanitized to a shell command, allowing authenticated attackers to execute arbitrary commands in the agent sandbox. The user is already allowed to instruct the agent to execute commands, but this bypasses the normal channels. Version 1.5.0 fixes the issue.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-78\", \"description\": \"CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-03-27T00:12:24.752Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-33718\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-03-27T20:04:54.607Z\", \"dateReserved\": \"2026-03-23T17:06:05.749Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-03-27T00:12:24.752Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-7H8W-HJ9J-8RJW

Vulnerability from github – Published: 2026-03-25 21:54 – Updated: 2026-03-27 21:37

Summary

OpenHands is Vulnerable to Command Injection through its Git Diff Handler

Details

Summary

A Command Injection vulnerability exists in the get_git_diff() method at openhands/runtime/utils/git_handler.py:134. The path parameter from the /api/conversations/{conversation_id}/git/diff API endpoint is passed unsanitized to a shell command, allowing authenticated attackers to execute arbitrary commands in the agent sandbox. The user is already allowed to instruct the agent to execute commands, but this bypasses the normal channels.

Details

Vulnerable Code Path

The vulnerability flows through these files:

API Endpoint (openhands/server/routes/files.py:267-277)

@app.get('/git/diff')
async def git_diff(
    path: str,  # <-- User input from HTTP request
    ...
):
    ...
    diff = await call_sync_from_async(runtime.get_git_diff, path, cwd)  # No sanitization

Runtime (openhands/runtime/base.py:1231-1233)

def get_git_diff(self, file_path: str, cwd: str) -> dict[str, str]:
    self.git_handler.set_cwd(cwd)
    return self.git_handler.get_git_diff(file_path)  # Passed directly

Vulnerable Method (openhands/runtime/utils/git_handler.py:10-12, 134)

# Command template with placeholder
GIT_DIFF_CMD = 'python3 /openhands/code/openhands/runtime/utils/git_diff.py "{file_path}"'

# Line 134 - VULNERABLE: User input directly interpolated
result = self.execute(self.git_diff_cmd.format(file_path=file_path), self.cwd)

Shell Execution (openhands/runtime/utils/git_diff.py:25-27)

def run(cmd: str, cwd: str) -> str:
    result = subprocess.run(
        args=cmd,
        shell=True,  # <-- Enables shell metacharacter interpretation
        stdout=subprocess.PIPE,
        stderr=subprocess.PIPE,
        cwd=cwd
    )

Root Cause

The file_path parameter is directly interpolated into a shell command string using Python's .format() method without any sanitization. When this command is executed with shell=True, shell metacharacters like ", ;, and # are interpreted, allowing command injection.

Example: - Input: test"; id # - Constructed command: python3 /script.py "test"; id #" - Shell interprets as two commands: python3 /script.py "test" AND id

Impact

Who is Affected

All OpenHands deployments exposing the /api/conversations/{id}/git/diff endpoint
Any authenticated user can exploit this vulnerability,

Attack Capabilities

An attacker can: 1. Execute arbitrary commands on the runtime container as root 2. Read sensitive files including .env, API keys, source code 3. Write arbitrary files to inject malicious code 4. Establish reverse shells for persistent access 5. Potentially escape the container if Docker is misconfigured

Mitigation

Users should update to the latest version of OpenHands that includes the changes from PR #13051. The fix replaces direct shell string formatting with proper argument array handling or rigorous path sanitization to prevent command chaining.

Severity ?

7.6 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "openhands"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.5.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33718"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-25T21:54:55Z",
    "nvd_published_at": "2026-03-27T01:16:19Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nA Command Injection vulnerability exists in the `get_git_diff()` method at `openhands/runtime/utils/git_handler.py:134`. The `path` parameter from the `/api/conversations/{conversation_id}/git/diff` API endpoint is passed unsanitized to a shell command, allowing authenticated attackers to execute arbitrary commands in the agent sandbox. The user is already allowed to instruct the agent to execute commands, but this bypasses the normal channels.\n\n---\n\n## Details\n\n### Vulnerable Code Path\n\nThe vulnerability flows through these files:\n\n1. **API Endpoint** (`openhands/server/routes/files.py:267-277`)\n```python\n@app.get(\u0027/git/diff\u0027)\nasync def git_diff(\n    path: str,  # \u003c-- User input from HTTP request\n    ...\n):\n    ...\n    diff = await call_sync_from_async(runtime.get_git_diff, path, cwd)  # No sanitization\n```\n\n2. **Runtime** (`openhands/runtime/base.py:1231-1233`)\n```python\ndef get_git_diff(self, file_path: str, cwd: str) -\u003e dict[str, str]:\n    self.git_handler.set_cwd(cwd)\n    return self.git_handler.get_git_diff(file_path)  # Passed directly\n```\n\n3. **Vulnerable Method** (`openhands/runtime/utils/git_handler.py:10-12, 134`)\n```python\n# Command template with placeholder\nGIT_DIFF_CMD = \u0027python3 /openhands/code/openhands/runtime/utils/git_diff.py \"{file_path}\"\u0027\n\n# Line 134 - VULNERABLE: User input directly interpolated\nresult = self.execute(self.git_diff_cmd.format(file_path=file_path), self.cwd)\n```\n\n4. **Shell Execution** (`openhands/runtime/utils/git_diff.py:25-27`)\n```python\ndef run(cmd: str, cwd: str) -\u003e str:\n    result = subprocess.run(\n        args=cmd,\n        shell=True,  # \u003c-- Enables shell metacharacter interpretation\n        stdout=subprocess.PIPE,\n        stderr=subprocess.PIPE,\n        cwd=cwd\n    )\n```\n\n### Root Cause\n\nThe `file_path` parameter is directly interpolated into a shell command string using Python\u0027s `.format()` method without any sanitization. When this command is executed with `shell=True`, shell metacharacters like `\"`, `;`, and `#` are interpreted, allowing command injection.\n\n**Example:**\n- Input: `test\"; id #`\n- Constructed command: `python3 /script.py \"test\"; id #\"`\n- Shell interprets as two commands: `python3 /script.py \"test\"` AND `id`\n\n---\n\n## Impact\n\n### Who is Affected\n- All OpenHands deployments exposing the `/api/conversations/{id}/git/diff` endpoint\n- Any authenticated user can exploit this vulnerability, \n\n### Attack Capabilities\nAn attacker can:\n1. **Execute arbitrary commands** on the runtime container as root\n2. **Read sensitive files** including `.env`, API keys, source code\n3. **Write arbitrary files** to inject malicious code\n4. **Establish reverse shells** for persistent access\n5. **Potentially escape the container** if Docker is misconfigured\n\n## Mitigation \n\nUsers should update to the latest version of OpenHands that includes the changes from PR #13051. The fix replaces direct shell string formatting with proper argument array handling or rigorous path sanitization to prevent command chaining.",
  "id": "GHSA-7h8w-hj9j-8rjw",
  "modified": "2026-03-27T21:37:14Z",
  "published": "2026-03-25T21:54:55Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/OpenHands/OpenHands/security/advisories/GHSA-7h8w-hj9j-8rjw"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33718"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenHands/OpenHands/pull/13051"
    },
    {
      "type": "WEB",
      "url": "https://docs.python.org/3/library/shlex.html#shlex.quote"
    },
    {
      "type": "WEB",
      "url": "https://docs.python.org/3/library/subprocess.html#security-considerations"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/OpenHands/OpenHands"
    },
    {
      "type": "WEB",
      "url": "https://owasp.org/www-community/attacks/Command_Injection"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenHands is Vulnerable to Command Injection through its Git Diff Handler"
}

FKIE_CVE-2026-33718

Vulnerability from fkie_nvd - Published: 2026-03-27 01:16 - Updated: 2026-03-30 13:26

Severity ?

7.6 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Summary

References

	URL	Tags
	security-advisories@github.com	https://docs.python.org/3/library/shlex.html#shlex.quote
	security-advisories@github.com	https://docs.python.org/3/library/subprocess.html#security-considerations
	security-advisories@github.com	https://github.com/OpenHands/OpenHands/pull/13051
	security-advisories@github.com	https://github.com/OpenHands/OpenHands/security/advisories/GHSA-7h8w-hj9j-8rjw
	security-advisories@github.com	https://owasp.org/www-community/attacks/Command_Injection

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenHands is software for AI-driven development. Starting in version 1.5.0, a Command Injection vulnerability exists in the `get_git_diff()` method at `openhands/runtime/utils/git_handler.py:134`. The `path` parameter from the `/api/conversations/{conversation_id}/git/diff` API endpoint is passed unsanitized to a shell command, allowing authenticated attackers to execute arbitrary commands in the agent sandbox. The user is already allowed to instruct the agent to execute commands, but this bypasses the normal channels. Version 1.5.0 fixes the issue."
    },
    {
      "lang": "es",
      "value": "OpenHands es un software para el desarrollo impulsado por IA. A partir de la versi\u00f3n 1.5.0, existe una vulnerabilidad de inyecci\u00f3n de comandos en el m\u00e9todo \u0027get_git_diff()\u0027 en \u0027openhands/runtime/utils/git_handler.py:134\u0027. El par\u00e1metro \u0027path\u0027 del endpoint de API \u0027/api/conversations/{conversation_id}/git/diff\u0027 se pasa sin sanear a un comando de shell, permitiendo a atacantes autenticados ejecutar comandos arbitrarios en el sandbox del agente. Al usuario ya se le permite instruir al agente para ejecutar comandos, pero esto elude los canales normales. La versi\u00f3n 1.5.0 corrige el problema."
    }
  ],
  "id": "CVE-2026-33718",
  "lastModified": "2026-03-30T13:26:29.793",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 7.6,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-03-27T01:16:19.483",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://docs.python.org/3/library/shlex.html#shlex.quote"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://docs.python.org/3/library/subprocess.html#security-considerations"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/OpenHands/OpenHands/pull/13051"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/OpenHands/OpenHands/security/advisories/GHSA-7h8w-hj9j-8rjw"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://owasp.org/www-community/attacks/Command_Injection"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-33718 (GCVE-0-2026-33718)

GHSA-7H8W-HJ9J-8RJW

Summary

Details

Vulnerable Code Path

Root Cause

Impact

Who is Affected

Attack Capabilities

Mitigation

FKIE_CVE-2026-33718

Tags

Sightings

Nomenclature