Is CVE-2026-54140 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54140 being exploited in the wild.

How severe is CVE-2026-54140?

High severity, with a CVSS score of 8.3, published 5 November 2026.

Which products and versions are affected?

Tinyhumans OpenHuman before 0.57.13.

How is CVE-2026-54140 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-54140?

Check whether you run Tinyhumans OpenHuman at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54140: OpenHuman prompt injection via MCP server tool descriptions

CVE-2026-54140 · Severity: high · CVSS 8.3 · Published 2026-11-05

OpenHuman is an agent framework that integrates external tools via MCP (Model Context Protocol) servers. Before version 0.57.13, malicious or compromised MCP servers could inject hidden instructions into tool descriptions that execute in the agent's context on every turn, potentially causing the agent to misuse other tools, leak data, or take unauthorized actions without explicit user input.

Technologies: Tinyhumans OpenHuman. Vendors: Tinyhumans.

Quick answers

Is CVE-2026-54140 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54140 being exploited in the wild.
How severe is CVE-2026-54140?: High severity, with a CVSS score of 8.3, published 5 November 2026.
Which products and versions are affected?: Tinyhumans OpenHuman before 0.57.13.
Is there a fix for CVE-2026-54140?: Yes: fixed in 0.57.13. Until then: Restrict MCP server configuration to trusted sources only. Avoid registering MCP servers from untrusted community registries (Smithery, mcp.run) until upgraded to 0.57.13. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54140 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-54140?: Check whether you run Tinyhumans OpenHuman at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 0.57.13

Restrict MCP server configuration to trusted sources only. Avoid registering MCP servers from untrusted community registries (Smithery, mcp.run) until upgraded to 0.57.13.

Technical details

The vulnerability is a prompt injection in the MCP tool registration pipeline. Tool descriptions, titles, names, and parameter definitions from remote MCP servers were placed verbatim into the agent's system-prompt-level context without sanitization or length bounds. The existing prompt-injection detector only screened user messages, not tool definitions loaded at session start. An attacker controlling or compromising an MCP server (from community registries or local configuration) could embed instruction-fence markers or LLM directives in a tool description field, which would be evaluated silently on every agent turn. The fix sanitizes tool definitions by stripping control characters and known fence markers, truncates oversized descriptions, and applies prompt-injection detection rules at registration time before adding tools to the registry.

Affected products

TinyHumans OpenHuman before 0.57.13

Timeline

2026-11-05: disclosed
2026-06-03: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.