PT-2026-28181 · Openhands · Openhands

Published 2026-03-25 · Updated 2026-04-10 · CVE-2026-33718

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenHands versions prior to 1.5.0

Description OpenHands is software for AI-driven development. A Command Injection vulnerability exists in the get git diff() method at openhands/runtime/utils/git handler.py:134. The path parameter from the /api/conversations/{conversation id}/git/diff API endpoint is passed unsanitized to a shell command, allowing authenticated attackers to execute arbitrary commands in the agent sandbox. The user is already allowed to instruct the agent to execute commands, but this bypasses the normal channels. The vulnerability stems from directly interpolating the file path parameter into a shell command string without sanitization, and using shell=True during command execution. An attacker can execute arbitrary commands, read sensitive files, write arbitrary files, establish reverse shells, and potentially escape the container.

Recommendations Update to version 1.5.0 or later.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-33718

GHSA-7H8W-HJ9J-8RJW

PYSEC-2026-106

Affected Products

Openhands

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33718.json · Exploit
• https://github.com/OpenHands/OpenHands/pull/13051 · Patch
• https://github.com/OpenHands/OpenHands/security/advisories/GHSA-7h8w-hj9j-8rjw · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-106 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33718 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33718 · Security Note
• https://osv.dev/vulnerability/GHSA-7h8w-hj9j-8rjw · Vendor Advisory
• https://github.com/OpenHands/OpenHands · Note
• https://twitter.com/CVEnew/status/2037513395906167053 · Twitter Post
• https://docs.python.org/3/library/subprocess.html#security-considerations · Note
• https://owasp.org/www-community/attacks/Command_Injection · Note
• https://docs.python.org/3/library/shlex.html#shlex.quote · Note
• https://reddit.com/r/VulnMatter/comments/1s475si/resumen_diario_de_vulnerabilidades_26032026 · Reddit Post
• https://twitter.com/giuseppe_1337/status/2042630080355070039 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1s473iq/resumen_diario_de_vulnerabilidades_26032026 · Reddit Post