# CVE-2026-55743: tinyhumansai OpenHuman OS command injection via allowlist bypass

Source: https://junglewise.ai/threats/cve-2026-55743-tinyhumansai-openhuman-os-command-injection-via-allowlist-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-17. Updated: 2026-06-20  
License: CC BY 4.0 with a link back

CVE-2026-55743 · Severity: critical · CVSS 9.6 · Published 2026-06-17

OpenHuman is a desktop AI agent that automates tasks by interacting with your computer. A security flaw allows a malicious document, email, or website to trick the agent into bypassing its safety rules and executing unauthorized commands on your machine. This could allow an attacker to steal your data, read or delete files, and gain full control over your computer.

Technologies: [Tinyhumansai OpenHuman](https://junglewise.ai/threats/technologies/openhuman). Vendors: [Tinyhumansai](https://junglewise.ai/threats/vendors/tinyhumansai).

## Quick answers

**Is CVE-2026-55743 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55743 being exploited in the wild.

**How severe is CVE-2026-55743?** Critical severity, with a CVSS score of 9.6, published 17 June 2026.

**Which products and versions are affected?** Tinyhumansai OpenHuman through 0.54.0.

**Is there a fix for CVE-2026-55743?** A patch was published on 2026-05-26: Fix committed in 60050aa09a870f53ed7e4cd40ed41fd2860329e7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55743 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-55743?** Check whether you run Tinyhumansai OpenHuman at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A command injection vulnerability exists in OpenHuman through version 0.54.0 due to two flaws in 'src/openhuman/security/policy.rs'. First, the 'is_args_safe()' function fails to block the 'find' command flags '-execdir' and '-okdir', which function identically to the blocked '-exec' and '-ok' flags. Second, 'skip_env_assignments()' strips inline environment variables before validation, allowing an attacker to use hooks like 'GIT_EXTERNAL_DIFF' to execute arbitrary code while appearing as a benign 'git' command. An attacker can exploit this via indirect prompt injection (e.g., a malicious email or web page) to achieve remote code execution with the privileges of the desktop user. The issue is fixed in version 0.56.0.

## Affected products

- tinyhumansai OpenHuman through 0.54.0

## Timeline

- 2026-05-26: patched: Fix committed in 60050aa09a870f53ed7e4cd40ed41fd2860329e7
- 2026-06-17: disclosed: CVE-2026-55743 published

## References

- [https://github.com/tinyhumansai/openhuman](https://github.com/tinyhumansai/openhuman)
- [https://github.com/tinyhumansai/openhuman/blob/v0.53.49-staging/src/openhuman/security/policy.rs](https://github.com/tinyhumansai/openhuman/blob/v0.53.49-staging/src/openhuman/security/policy.rs)
- [https://github.com/tinyhumansai/openhuman/commit/60050aa09a870f53ed7e4cd40ed41fd2860329e7](https://github.com/tinyhumansai/openhuman/commit/60050aa09a870f53ed7e4cd40ed41fd2860329e7)

## Related threats

- [OpenHuman credential exposure in process environment on macOS](https://junglewise.ai/threats/cve-2026-54146-openhuman-is-an-open-source-agent-harness-available-as-a-desktop)
- [OpenHuman unauthorized persistent command execution via channel messages](https://junglewise.ai/threats/cve-2026-54143-openhuman-is-an-open-source-agent-harness-available-as-a-desktop)
- [OpenHuman local server information disclosure via unauthenticated SSE endpoint](https://junglewise.ai/threats/cve-2026-49405-openhuman-is-an-open-source-agent-harness-available-as-a-desktop)
- [OpenHuman Socket.IO authentication bypass](https://junglewise.ai/threats/cve-2026-49393-openhuman-is-an-open-source-agent-harness-available-as-a-desktop)