CVE-2026-19022 in OpenHands
Summary
by MITRE • 08/06/2026
A vulnerability was determined in OpenHands up to 0.62.0. The affected element is the function initialize_repo of the file OpenHands/resolver/send_pull_request.py. This manipulation causes command injection. Remote exploitation of the attack is possible. The vendor deleted the original GitHub issue report. It appears that the affected path/file got removed in version 1.7.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/06/2026
The vulnerability identified in OpenHands up to version 0.62.0 represents a critical command injection flaw within the initialize_repo function located in OpenHands/resolver/send_pull_request.py. This type of vulnerability falls under CWE-78 which specifically addresses improper neutralization of special elements used in operating system commands, making it particularly dangerous as it allows attackers to execute arbitrary commands on the affected system. The flaw exists due to insufficient input validation and sanitization of user-provided data that gets directly incorporated into system command execution contexts.
The operational impact of this vulnerability extends significantly beyond typical code injection scenarios, as remote exploitation is possible through the compromised function. Attackers can leverage this weakness to execute malicious commands on systems running vulnerable versions of OpenHands, potentially leading to complete system compromise, data exfiltration, or lateral movement within network environments. The fact that the original GitHub issue report was deleted by the vendor suggests the severity and potential for widespread exploitation, as vendors often remove such reports once vulnerabilities are patched to prevent exploitation.
The technical implementation of this vulnerability stems from improper handling of repository initialization parameters within the send_pull_request.py file, where user-controllable inputs are directly passed to system commands without proper sanitization or validation. This pattern creates an ideal environment for command injection attacks, particularly when the application processes pull requests that involve repository operations. The vulnerability's persistence across multiple versions until 1.7.0 indicates a prolonged exposure window where organizations could have been compromised without awareness.
Organizations using OpenHands should implement immediate mitigations including updating to version 1.7.0 or later where the vulnerable code path has been removed, alongside network-based protections such as firewalls and intrusion detection systems that can monitor for suspicious command execution patterns. Additionally, implementing proper input validation and sanitization measures, following the principle of least privilege for the application's execution context, and conducting regular security audits of automated processes can help prevent exploitation attempts. The ATT&CK framework categorizes this vulnerability under T1059.001 - Command and Scripting Interpreter, with potential lateral movement capabilities through command execution. Security teams should also consider implementing application whitelisting policies to restrict the execution of unauthorized system commands, particularly in environments where OpenHands is deployed.