Read the docs
TI-2026-85521 Aliases CVE-2026-54142

Prompt injection in OpenHuman background sync runs Composio actions

Priority HIGH 73CWE-1427Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

OpenHuman by tinyhumansai is affected before 0.57.13. Background sync for connected services such as email places external content into the model context without neutralizing embedded instructions (CWE-1427). An attacker who can deliver content to a connected account can make background agents run Composio actions without approval, because ApprovalGate treats them as pre-authorized. The attacker can then send data, post messages or disclose memory.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.57.13, background synchronization for connected services such as email, Slack, and Notion stores raw external content and later places it in the model context of autonomous background agents without neutralizing embedded instructions. ApprovalGate treats tool calls without an interactive chat context as pre-authorized automation, so attacker-authored content processed during a background tick can influence the model to invoke Composio actions without presenting an approval request. An attacker who can deliver content to a connected account can use this path to send or forward data, post messages, create or modify third-party content, or disclose information from OpenHuman memory and integrations. The issue requires an active integration and successful model interpretation of the injected instructions. This issue is fixed in version 0.57.13.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00524 44th percentileScored 2026-11-07
Fix Fixed openhuman (tinyhumansai): 0.57.13

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
tinyhumansaiopenhumanbefore 0.57.130.57.13Patch availableCNA
  • openhuman Vendortinyhumansai Affected before 0.57.13 Fixed in 0.57.13 Patch available CNA

Remediation

Upgrade OpenHuman to version 0.57.13, which contains the fix.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA openhuman (tinyhumansai) Fixed in 0.57.13

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-54142
  2. 2026-11-05 CISA SSVC decision points changed
  3. 2026-11-05 Priority changed: MEDIUM → HIGH
  4. 2026-11-06 Affected versions changed · Red Hat
  5. 2026-11-06 CVSS score added · Red Hat

References

Other 4

  • TI-2026-75524 OpenHuman Telegram login callback lets attackers swap user sessions CVSS 3.1HIGH 8.1
  • TI-2026-85515 OpenHuman event stream endpoint leaks user-facing data without authentication CVSS 3.1MEDIUM 6.2
  • TI-2026-85522 OpenHuman lets channel messages create unapproved shell cron jobs CVSS 3.1CRITICAL 9.8
  • TI-2026-40241 OpenHuman desktop agent shell tool sandbox bypass leads to arbitrary command execution CVSS 4.0CRITICAL 9.4
  • TI-2026-85516 OpenHuman Yuanbao channel bypasses approval for node_exec commands CVSS 3.1CRITICAL 9.0
  • TI-2026-85523 OpenHuman bearer token leak via process environment variable on macOS CVSS 3.1HIGH 8.8
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences