CVE-2026-19022: OpenHands Command Injection Vulnerability

CVE-2026-19022 Overview

CVE-2026-19022 is a command injection vulnerability in OpenHands versions up to and including 0.62.0. The flaw resides in the initialize_repo function within OpenHands/resolver/send_pull_request.py. Attackers can manipulate input to this function to inject and execute arbitrary shell commands. Remote exploitation is possible over the network with low privileges required. The vendor deleted the original GitHub issue report, and the affected file appears to have been removed in version 1.7.0. The vulnerability is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Authenticated remote attackers can inject arbitrary commands through the initialize_repo function, leading to unauthorized command execution within the OpenHands resolver context.

Affected Products

OpenHands versions up to 0.62.0
OpenHands resolver component (OpenHands/resolver/send_pull_request.py)
Fixed by removal of the affected path in OpenHands 1.7.0

Discovery Timeline

2026-08-06 - CVE-2026-19022 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-19022

Vulnerability Analysis

CVE-2026-19022 is a command injection vulnerability affecting the OpenHands automated code resolver. The initialize_repo function in send_pull_request.py fails to properly neutralize special elements passed to a downstream shell or subprocess call. Attackers who can influence repository initialization parameters can embed shell metacharacters or additional commands, which the function then executes.

The vulnerability sits in a code path used to prepare repositories for automated pull request generation. Because OpenHands is an AI agent framework that operates on user-supplied repositories and issue content, the attack surface extends to any input source that flows into repository initialization logic.

Root Cause

The root cause is improper input neutralization ([CWE-74]) in the initialize_repo function. User-controllable data reaches a command-executing sink without sufficient sanitization or use of safe process invocation APIs. Passing untrusted values through shell interpretation rather than argument arrays allows metacharacter injection.

Attack Vector

Exploitation occurs over the network and requires low privileges. An attacker submits crafted repository metadata or issue content that OpenHands processes through the resolver. When initialize_repo handles that input, the injected commands execute in the OpenHands process context. See the VulDB CVE-2026-19022 entry and the OpenHands GitHub repository for reference material. No verified public proof-of-concept code is available at time of publication.

Detection Methods for CVE-2026-19022

Indicators of Compromise

Unexpected child processes spawned by the OpenHands resolver, particularly shell interpreters (sh, bash) invoked from Python worker processes
Outbound network connections initiated from OpenHands hosts to unknown or attacker-controlled endpoints
Repository or issue payloads containing shell metacharacters such as backticks, $(), ;, &&, or | in fields consumed by the resolver
File writes or credential access from the OpenHands runtime user outside expected working directories

Detection Strategies

Instrument process telemetry on hosts running OpenHands to alert on shell invocations descended from the resolver Python process
Inspect application logs for calls into initialize_repo with unusual argument content
Correlate repository ingestion events with subsequent process and network activity to identify anomalous execution chains

Monitoring Recommendations

Log all subprocess invocations from the OpenHands service and forward them to a centralized analytics platform
Monitor egress traffic from OpenHands workers for connections to non-allowlisted destinations
Track version inventory to identify hosts still running OpenHands 0.62.0 or earlier

How to Mitigate CVE-2026-19022

Immediate Actions Required

Upgrade OpenHands to version 1.7.0 or later, where the affected file has been removed
Audit any deployments running versions up to 0.62.0 and restrict network exposure until upgraded
Review historical logs for suspicious initialize_repo invocations and follow-on process activity
Rotate credentials, tokens, and SSH keys accessible from the OpenHands runtime if compromise is suspected

Patch Information

The affected path OpenHands/resolver/send_pull_request.py was removed in OpenHands version 1.7.0. The vendor deleted the original GitHub issue #14903, so no coordinated advisory is published in the project's release notes. Refer to the VulDB vulnerability entry #386426 for tracking.

Workarounds

Restrict network access to OpenHands instances so only trusted operators can submit repository or issue inputs
Run OpenHands under a least-privilege service account with no access to production secrets
Isolate the resolver process in a sandboxed container with restricted filesystem and network egress
Apply input validation at any upstream integration that forwards repository metadata to OpenHands

bash

# Configuration example: upgrade OpenHands and confirm the vulnerable file is absent
pip install --upgrade 'openhands>=1.7.0'
python -c "import importlib.util, sys; \
sys.exit(0 if importlib.util.find_spec('OpenHands.resolver.send_pull_request') is None else 1)"