OpenHuman lets channel messages create unapproved shell cron jobs
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass, Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-285 and CWE-78.
Summary
OpenHuman, an open-source agent available as a desktop application and Rust library, is affected before 0.57.13. An attacker who can send messages to a configured external channel can make the agent create persistent shell cron jobs without human approval (CWE-285). Command validation also accepts leading environment assignments that can redirect allowed commands to helper executables, and a demonstrated exploit needs a suitable helper already on the host. The scheduler runs these jobs with the privileges of the OpenHuman runtime user.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
Description from the CNA
OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before version 0.57.13, an attacker who can send messages to a configured external channel can cause the agent to create persistent shell cron jobs without human approval. The scheduler later executes these jobs with the privileges of the OpenHuman runtime user. Command validation also permits leading environment assignments that can redirect allowed commands to executable helpers. The demonstrated exploit requires a suitable helper executable already present on the host. This can lead to unauthorized persistent command execution and compromise data and resources accessible to OpenHuman. This issue is fixed in version 0.57.13.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| tinyhumansai | openhuman | before 0.57.13 | 0.57.13 | Patch available | CNA |
- openhuman Vendortinyhumansai Affected before 0.57.13 Fixed in 0.57.13 Patch available CNA
Remediation
Update OpenHuman to version 0.57.13, which fixes this issue.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
- Fix · CNA openhuman (tinyhumansai) Fixed in 0.57.13
Timeline
- 2026-11-05 Threatist record created from CVE-2026-54143
References
Other 6
- https://github.com/tinyhumansai/openhuman/security/advisories/GHSA-f46p-6vf9-64mm
- https://github.com/tinyhumansai/openhuman/pull/2736
- https://github.com/tinyhumansai/openhuman/pull/3227
- https://github.com/tinyhumansai/openhuman/commit/3a7180da7765af861bf44d79e025fc67dbeae0ca
- https://github.com/tinyhumansai/openhuman/commit/4d9fe2072fdd5787023bafa2c7a63b6f8a7e9b93
- https://github.com/tinyhumansai/openhuman/releases/tag/v0.57.13
More tinyhumansai vulnerabilities
- TI-2026-85521 Prompt injection in OpenHuman background sync runs Composio actions CVSS 3.1HIGH 8.7
- TI-2026-75524 OpenHuman Telegram login callback lets attackers swap user sessions CVSS 3.1HIGH 8.1
- TI-2026-85515 OpenHuman event stream endpoint leaks user-facing data without authentication CVSS 3.1MEDIUM 6.2
- TI-2026-40241 OpenHuman desktop agent shell tool sandbox bypass leads to arbitrary command execution CVSS 4.0CRITICAL 9.4
- TI-2026-85516 OpenHuman Yuanbao channel bypasses approval for node_exec commands CVSS 3.1CRITICAL 9.0
- TI-2026-85523 OpenHuman bearer token leak via process environment variable on macOS CVSS 3.1HIGH 8.8
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences