Executive brief
OpenHands, an AI-powered software development agent, is vulnerable to a security flaw in how it handles file difference requests. An authenticated user can exploit this to execute unauthorized commands on the underlying system with root privileges. This could lead to the theft of sensitive API keys, source code, or full control over the environment where the agent is running.
Technical details
A command injection vulnerability exists in the `get_git_diff()` method within `openhands/runtime/utils/git_handler.py`. The `path` parameter from the `/api/conversations/{conversation_id}/git/diff` endpoint is passed unsanitized to a shell command via Python's `.format()` method and executed using `subprocess.run` with `shell=True`. An authenticated attacker can use shell metacharacters (e.g., `;`, `&`, `|`) in the file path to execute arbitrary OS commands as the root user. This allows for full container compromise, sensitive file exfiltration (such as `.env` files), and potential container escape. The issue is fixed in version 1.5.0 by implementing proper argument handling and sanitization.
Affected products
- OpenHands openhands-ai >= 0, < 1.5.0
Timeline
- 2026-03-23: disclosed: Advisory published by raymyers
- 2026-03-25: advisory: GitHub Advisory published (GHSA-7h8w-hj9j-8rjw)
- 2026-03-27: other: NVD published CVE-2026-33718