CVE-2026-54141 in OpenHuman
Summary
by MITRE • 11/05/2026
OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.57.13, a remote direct message received through a configured Yuanbao channel is converted into a generic channel AgentTurnRequest that uses the default tool policy without establishing an interactive approval context. Under the default Supervised autonomy policy with Node enabled, node_exec is classified as a write operation that should prompt for approval, but ApprovalGate treats missing APPROVAL_CHAT_CONTEXT as a non-interactive turn and allows execution. Because Yuanbao direct messages are open by default, an external sender who can message the connected bot can influence the agent to execute JavaScript and operating-system commands as the OpenHuman user without an approval prompt. The issue requires a configured Yuanbao channel, the default approval-requiring policy state, Node availability, and successful model selection of node_exec. This issue is fixed in version 0.57.13.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability identified within OpenHuman versions prior to 0.57.13 represents a critical failure in the agent's autonomy governance framework, specifically concerning how external inputs are processed under supervised execution policies. OpenHuman functions as an open-source agent harness that allows users to configure various channels for interaction with AI agents. The core issue arises from a misclassification of input context when handling remote direct messages received through a configured Yuanbao channel. Instead of preserving the specific interactive nature of these incoming messages, the system converts them into generic AgentTurnRequest objects. This conversion strips away critical metadata required by the approval gate mechanism to determine whether user intervention is necessary before executing sensitive operations. Consequently, the agent fails to establish an appropriate interactive approval context for inputs originating from this external channel, leading to a bypass of intended security controls.
From a technical perspective, the flaw lies in the interaction between the input parsing logic and the Supervised autonomy policy engine. Under the default configuration with Node enabled, specific actions such as node_exec are classified as write operations that mandate user approval before execution. The ApprovalGate component is designed to check for an APPROVAL_CHAT_CONTEXT flag or similar indicator to determine if a turn requires interactive consent. However, because Yuanbao direct messages are open by default and lack this context upon conversion to the generic AgentTurnRequest format, the ApprovalGate incorrectly interprets these requests as non-interactive turns that do not require approval. This logic error allows an external sender who can message the connected bot to influence the agent into executing JavaScript code or operating system commands on behalf of the OpenHuman user without any prompt for consent. The vulnerability effectively neutralizes the supervised mode, reducing it to autonomous execution for inputs coming through this specific channel.
The operational impact of this vulnerability is severe, as it enables unauthorized remote command execution and arbitrary script running under the privileges of the authenticated OpenHuman user. An attacker who can establish a connection with the Yuanbao bot associated with an affected instance can exploit this flaw to execute malicious payloads directly on the host system or within the agent's runtime environment. This could lead to data exfiltration, lateral movement within internal networks if accessible services are present, or complete compromise of the user's digital identity and connected resources. The risk is exacerbated by the fact that Yuanbao direct messages are open by default, meaning no prior authentication relationship with a specific trusted contact list is strictly required for an attacker to initiate communication, provided they can discover or be invited to the bot channel.
This vulnerability aligns with CWE-250, which describes execution with unnecessary privileges, as well as CWE-862, missing authorization, since the agent fails to enforce access control checks before performing write operations. In terms of MITRE ATT&CK mapping, this behavior facilitates techniques associated with Command and Scripting Interpreter (T1059) for executing arbitrary code, and potentially Defense Evasion if used to bypass logging or monitoring mechanisms by operating outside normal approval workflows. The exploitation chain relies on the presence of a configured Yuanbao channel, the default approval-requiring policy state being active, Node availability within the agent's capabilities, and successful model selection of node_exec. To mitigate this risk, organizations must upgrade OpenHuman to version 0.57.13 or later, where the input handling logic has been corrected to properly preserve interactive context for external messages. Additionally, until an update is applied, administrators should consider disabling Yuanbao channels entirely or restricting them to trusted contacts only if such a feature exists in earlier versions, and ensure that autonomy policies are reviewed to prevent unintended execution paths through less secure communication endpoints.