CVE-2026-55743: OpenHuman Desktop Agent RCE Vulnerability

CVE-2026-55743 Overview

CVE-2026-55743 is a command injection vulnerability in the OpenHuman desktop agent through version 0.54.0. The flaw resides in the shell tool command allowlist enforced by the SecurityPolicy in src/openhuman/security/policy.rs. Attackers bypass the default Supervised security policy and execute arbitrary operating system commands with the privileges of the desktop user. Because the sandbox is the primary trust boundary between untrusted LLM-processed content and the host, an attacker can achieve remote code execution through indirect prompt injection delivered via documents, email, calendar events, or web pages.

Critical Impact
Indirect prompt injection achieves arbitrary command execution on the host, enabling data exfiltration, arbitrary file read/write, and lateral movement.

Affected Products

OpenHuman desktop agent versions through 0.54.0
Default Supervised security policy configurations
Fixed in 0.54.22-staging and first stable release 0.56.0

Discovery Timeline

2026-06-17 - CVE-2026-55743 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-55743

Vulnerability Analysis

The vulnerability is a command injection issue [CWE-78] in the shell tool allowlist of the OpenHuman desktop agent. The allowlist is intended to constrain the commands an LLM-controlled agent can execute through the shell tool. Two parsing flaws combine to defeat that boundary.

The first flaw is in is_args_safe(). The function blocks the find flags -exec and -ok but does not block -execdir and -okdir. The latter flags are functionally identical and also execute an arbitrary command for each matched file.

The second flaw is in skip_env_assignments(). The function strips leading inline KEY=value environment-variable assignments before allowlist validation. A command such as GIT_EXTERNAL_DIFF=<cmd> git diff is validated as the allowed git diff, but when executed via the shell, runs <cmd> through git's environment-driven hooks.

Root Cause

The allowlist validator strips environment-variable prefixes prior to checking the command, and its find flag denylist is incomplete. Both gaps allow attacker-controlled commands to pass validation while reaching the shell unchanged.

Attack Vector

An attacker plants a malicious document, email, calendar event, or web page that the agent ingests. The injected instructions direct the agent to run a benign-looking allowlisted command such as git diff with an attacker-supplied GIT_EXTERNAL_DIFF prefix, or a find invocation using -execdir. The shell executes the attacker's command with the desktop user's privileges.

rust

// Patch from commit 60050aa09a870f53ed7e4cd40ed41fd2860329e7
// Source: https://github.com/tinyhumansai/openhuman/commit/60050aa09a870f53ed7e4cd40ed41fd2860329e7
// The fix blocks -execdir and -okdir for find and removes the
// inline KEY=value stripping that bypassed allowlist validation.
// See src/openhuman/security/policy.rs for the corrected checks.

Detection Methods for CVE-2026-55743

Indicators of Compromise

Shell invocations from the OpenHuman agent process containing find with -execdir or -okdir arguments.
Process command lines starting with inline environment assignments such as GIT_EXTERNAL_DIFF=, GIT_SSH_COMMAND=, GIT_PAGER=, or LD_PRELOAD= followed by an allowlisted binary like git.
Unexpected child processes spawned by git, find, or the OpenHuman agent that perform network egress or write outside the workspace.

Detection Strategies

Monitor process creation telemetry for the OpenHuman agent and alert on child processes that do not match expected allowlisted binaries.
Inspect command-line arguments for -execdir/-okdir and for KEY=value prefixes preceding allowlisted commands.
Correlate agent ingestion events (document, email, web fetch) with subsequent shell tool invocations to surface indirect prompt injection chains.

Monitoring Recommendations

Log full command lines and parent-child process relationships on hosts running the OpenHuman desktop agent.
Alert on outbound network connections initiated by processes spawned through the agent's shell tool.
Track file read/write activity by agent-spawned processes against sensitive paths such as SSH keys, browser profiles, and credential stores.

How to Mitigate CVE-2026-55743

Immediate Actions Required

Upgrade the OpenHuman desktop agent to 0.56.0 or later, or to 0.54.22-staging if running the staging channel.
Audit existing agent deployments for the vulnerable policy.rs logic and confirm the patched commit 60050aa09a870f53ed7e4cd40ed41fd2860329e7 is present.
Review agent activity logs for prior invocations of find -execdir, find -okdir, or git commands preceded by KEY=value assignments.

Patch Information

The issue was fixed in commit 60050aa09a870f53ed7e4cd40ed41fd2860329e7, first released in 0.54.22-staging and first stable in 0.56.0. The patch blocks -execdir and -okdir for find and removes the inline environment-assignment stripping. See the GitHub Commit 60050aa and the OpenHuman Security Policy File.

Workarounds

Switch the agent to a stricter non-Supervised policy that disables the shell tool until the patch can be applied.
Restrict the agent's filesystem and network access using OS-level sandboxing such as AppArmor, SELinux, or macOS sandbox profiles.
Disable ingestion of untrusted external content (web pages, third-party email, shared calendars) by the agent until patched.

bash

# Verify the installed OpenHuman agent version and upgrade
openhuman --version
# Upgrade to a fixed release (0.56.0 stable or 0.54.22-staging)
# Refer to project release notes at:
# https://github.com/tinyhumansai/openhuman