CVE-2026-54141 Details
Description
OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.57.13, a remote direct message received through a configured Yuanbao channel is converted into a generic channel AgentTurnRequest that uses the default tool policy without establishing an interactive approval context. Under the default Supervised autonomy policy with Node enabled, node_exec is classified as a write operation that should prompt for approval, but ApprovalGate treats missing APPROVAL_CHAT_CONTEXT as a non-interactive turn and allows execution. Because Yuanbao direct messages are open by default, an external sender who can message the connected bot can influence the agent to execute JavaScript and operating-system commands as the OpenHuman user without an approval prompt. The issue requires a configured Yuanbao channel, the default approval-requiring policy state, Node availability, and successful model selection of node_exec. This issue is fixed in version 0.57.13.
A critical vulnerability has been identified in OpenHuman versions prior to 0.57.13, allowing remote code execution via the Yuanbao messaging channel. The issue arises because direct messages received through Yuanbao are processed without the necessary approval context, enabling external senders to execute JavaScript and operating system commands as the OpenHuman user. This exploitation occurs under the default Supervised autonomy policy, with Node.js enabled, and requires the successful model selection of the 'node_exec' tool, which is designed to execute JavaScript through Node.js and can invoke OS commands via 'child_process'.
Users can update to OpenHuman version 0.57.13 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/tinyhumansai/openhuman/commit/3a7180da7765af861bf44d79e025fc67dbeae0ca | [email protected] | Source CodeVendor |
| https://github.com/tinyhumansai/openhuman/pull/3227 | [email protected] | Source CodeVendor |
| https://github.com/tinyhumansai/openhuman/releases/tag/v0.57.13 | [email protected] | Release NotesVendor |
| https://github.com/tinyhumansai/openhuman/security/advisories/GHSA-gg3m-wgmq-vhmx | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| tinyhumansai OpenHuman | < 0.57.13 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | New CVE Received | [email protected] |