Read the docs
TI-2026-85516 Aliases CVE-2026-54141

OpenHuman Yuanbao channel bypasses approval for node_exec commands

Priority MEDIUM 40CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Security bypass, Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862 and CWE-94.

Summary

OpenHuman, an open-source agent from tinyhumansai, is affected before 0.57.13. A remote direct message received through a configured Yuanbao channel runs with the default tool policy and no interactive approval context, so the approval gate allows node_exec without a prompt (CWE-862). A remote sender who can message the connected bot can make the agent run JavaScript and operating-system commands as the OpenHuman user when the default Supervised policy and Node are enabled.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.57.13, a remote direct message received through a configured Yuanbao channel is converted into a generic channel AgentTurnRequest that uses the default tool policy without establishing an interactive approval context. Under the default Supervised autonomy policy with Node enabled, node_exec is classified as a write operation that should prompt for approval, but ApprovalGate treats missing APPROVAL_CHAT_CONTEXT as a non-interactive turn and allows execution. Because Yuanbao direct messages are open by default, an external sender who can message the connected bot can influence the agent to execute JavaScript and operating-system commands as the OpenHuman user without an approval prompt. The issue requires a configured Yuanbao channel, the default approval-requiring policy state, Node availability, and successful model selection of node_exec. This issue is fixed in version 0.57.13.

Why it matters now

EPSS 0.00762 55th percentileScored 2026-11-07
Fix Fixed openhuman (tinyhumansai): 0.57.13

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
tinyhumansaiopenhumanbefore 0.57.130.57.13Patch availableCNA
  • openhuman Vendortinyhumansai Affected before 0.57.13 Fixed in 0.57.13 Patch available CNA

Remediation

Update OpenHuman to version 0.57.13, the version that fixes this flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

  • Fix · CNA openhuman (tinyhumansai) Fixed in 0.57.13

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-54141

References

Other 4

  • TI-2026-85521 Prompt injection in OpenHuman background sync runs Composio actions CVSS 3.1HIGH 8.7
  • TI-2026-75524 OpenHuman Telegram login callback lets attackers swap user sessions CVSS 3.1HIGH 8.1
  • TI-2026-85515 OpenHuman event stream endpoint leaks user-facing data without authentication CVSS 3.1MEDIUM 6.2
  • TI-2026-85522 OpenHuman lets channel messages create unapproved shell cron jobs CVSS 3.1CRITICAL 9.8
  • TI-2026-40241 OpenHuman desktop agent shell tool sandbox bypass leads to arbitrary command execution CVSS 4.0CRITICAL 9.4
  • TI-2026-85523 OpenHuman bearer token leak via process environment variable on macOS CVSS 3.1HIGH 8.8
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences