# CVE-2026-54141: OpenHuman remote code execution via unapproved Yuanbao channel messages

Source: https://junglewise.ai/threats/cve-2026-54141-openhuman-is-an-open-source-agent-harness-available-as-a-desktop  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-11-05  
License: CC BY 4.0 with a link back

CVE-2026-54141 · Severity: critical · CVSS 9 · Published 2026-11-05

OpenHuman is an open-source agent automation platform available as a desktop application and Rust library. An attacker who can send direct messages through a connected Yuanbao messaging channel can trigger the agent to execute arbitrary JavaScript and operating-system commands without requiring user approval, potentially leading to data theft, malware installation, or system compromise on the user's computer.

Technologies: [Tinyhumans OpenHuman](https://junglewise.ai/threats/technologies/tinyhumans-openhuman). Vendors: [Tinyhumans](https://junglewise.ai/threats/vendors/tinyhumans).

## Quick answers

**Is CVE-2026-54141 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54141 being exploited in the wild.

**How severe is CVE-2026-54141?** Critical severity, with a CVSS score of 9, published 5 November 2026.

**Which products and versions are affected?** Tinyhumans OpenHuman before 0.57.13.

**Is there a fix for CVE-2026-54141?** Yes: fixed in 0.57.13. Until then: Disable or restrict Yuanbao channel integration until upgrading, or configure network-level restrictions on Yuanbao message routing to the agent. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54141 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54141?** Check whether you run Tinyhumans OpenHuman at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.57.13

Disable or restrict Yuanbao channel integration until upgrading, or configure network-level restrictions on Yuanbao message routing to the agent.

## Technical details

The vulnerability stems from improper approval context handling in the ApprovalGate component. Remote direct messages received through Yuanbao channels are converted to AgentTurnRequest objects that lack an APPROVAL_CHAT_CONTEXT, causing the approval system to incorrectly classify them as non-interactive trusted automation and skip the required approval prompt. This affects the default Supervised autonomy policy with Node enabled, allowing attacker-controlled input to invoke node_exec and other privileged tools. The flaw requires a configured Yuanbao channel and model selection of the node_exec tool; it is fixed in version 0.57.13 by implementing explicit agent turn origin tracking and fail-closed approval gate semantics.

## Affected products

- tinyhumans OpenHuman before 0.57.13

## Timeline

- 2026-11-05: disclosed

## References

- [https://github.com/tinyhumansai/openhuman/commit/3a7180da7765af861bf44d79e025fc67dbeae0ca](https://github.com/tinyhumansai/openhuman/commit/3a7180da7765af861bf44d79e025fc67dbeae0ca)
- [https://github.com/tinyhumansai/openhuman/pull/3227](https://github.com/tinyhumansai/openhuman/pull/3227)

## Related threats

- [OpenHuman credential exposure through approval session identifier](https://junglewise.ai/threats/cve-2026-54145-openhuman-is-an-open-source-agent-harness-available-as-a-desktop)
- [OpenHuman prompt injection in background synchronization](https://junglewise.ai/threats/cve-2026-54142-openhuman-is-an-open-source-agent-harness-available-as-a-desktop)
- [OpenHuman prompt injection via MCP server tool descriptions](https://junglewise.ai/threats/cve-2026-54140-openhuman-is-an-open-source-agent-harness-available-as-a-desktop)