CVE-2026-55743 Details

A vulnerability in the OpenHuman desktop agent's security policy, affecting versions through 0.54.0, allows users to bypass the shell command command allowlist and execute arbitrary operating system commands with the privileges of the desktop user. This issue arises from two flaws in the security policy implementation: first, the command allowlist improperly validates certain 'find' command flags that can execute arbitrary commands; second, the policy fails to correctly handle leading environment variable assignments, allowing commands to be manipulated in a way that executes unauthorized actions. Exploiting this vulnerability could lead to remote code execution on the user's machine, especially through indirect prompt injection via malicious documents or web content.

Users can update to OpenHuman version 0.56.0 or later, where this vulnerability has been fixed by blocking the 'find' command flags that could be exploited.