CVE-2026-54142 in OpenHuman
Summary
by MITRE • 11/05/2026
OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.57.13, background synchronization for connected services such as email, Slack, and Notion stores raw external content and later places it in the model context of autonomous background agents without neutralizing embedded instructions. ApprovalGate treats tool calls without an interactive chat context as pre-authorized automation, so attacker-authored content processed during a background tick can influence the model to invoke Composio actions without presenting an approval request. An attacker who can deliver content to a connected account can use this path to send or forward data, post messages, create or modify third-party content, or disclose information from OpenHuman memory and integrations. The issue requires an active integration and successful model interpretation of the injected instructions. This issue is fixed in version 0.57.13.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability identified within OpenHuman prior to version 0.57.13 represents a critical failure in input validation and context isolation for autonomous background agents. OpenHuman functions as an open-source agent harness that integrates with various external services such as email, Slack, and Notion through Rust libraries and desktop applications. The core architectural flaw lies in how the system handles data synchronization from these connected services. Specifically, during background synchronization processes, raw content retrieved from external sources is stored without sufficient sanitization or neutralization of embedded instructions. This untrusted input is subsequently injected directly into the model context used by autonomous agents operating in the background, creating a direct pathway for prompt injection attacks where malicious actors can manipulate the behavior of AI-driven automation tools.
The operational impact stems from the specific design choice made within the ApprovalGate mechanism, which governs how tool calls are authorized. In this architecture, any tool invocation that occurs without an interactive chat context is automatically treated as pre-authorized automation. This assumption holds true for legitimate background tasks but becomes a severe security liability when combined with the aforementioned input handling flaw. Because the system does not require explicit user approval for actions triggered by non-interactive agents, it fails to provide a necessary human-in-the-loop checkpoint. Consequently, if an attacker can deliver malicious content into one of the connected accounts, that content is processed during background synchronization cycles and fed directly into the language model's context window without any filtering or instruction neutralization steps.
This sequence allows an adversary who has compromised or controls access to a linked account to execute arbitrary actions through the AI agent. By embedding specific instructions within emails, Slack messages, or Notion documents, attackers can trick the background agents into invoking Composio actions that were not intended by the user. The potential consequences are extensive and include the unauthorized sending or forwarding of sensitive data, posting malicious messages on behalf of the user, creating or modifying third-party content in connected platforms, and disclosing confidential information stored within OpenHuman's memory or integrations. This effectively bypasses standard security controls designed to prevent automated systems from performing high-privilege actions without explicit consent.
From a classification perspective, this vulnerability aligns with CWE-798, which covers the use of hardcoded credentials or default passwords, but more accurately maps to CWE-1321 and general prompt injection vulnerabilities where untrusted data influences system behavior. In terms of attack vectors, it corresponds to MITRE ATT&CK techniques related to Command and Scripting Interpreter abuse and potentially Data Exfiltration via Application Layer Protocol if the agent is used to transmit stolen data externally. The root cause is a lack of proper input validation and context separation, allowing external content to be interpreted as executable instructions rather than passive data.
To mitigate this risk, users must upgrade immediately to version 0.57.13 or later, where these issues have been addressed through improved sanitization protocols and stricter authorization checks for background operations. For organizations still evaluating the technology, it is crucial to implement network-level controls such as firewalls that restrict outbound connections from agent processes unless explicitly whitelisted. Additionally, adopting a zero-trust approach to AI integrations involves ensuring that any data ingested by autonomous agents undergoes rigorous neutralization of control characters and instruction-like patterns before entering the model context. Regular audits of connected service permissions should also be conducted to limit the blast radius in case of future vulnerabilities.