Command Injection Vulnerability in OpenHands by OpenHands
CVE-2026-19022

5.3MEDIUM

Key Information:

Vendor

OpenHands

Status
Openhands
Vendor
CVE Published:
6 August 2026

What is CVE-2026-19022?

A command injection vulnerability exists in the OpenHands application up to version 0.62.0, specifically in the initialize_repo function located in the send_pull_request.py file. This security flaw can be exploited remotely, allowing attackers to execute arbitrary commands on the server. The vendor has removed the corresponding GitHub issue report, highlighting the severity of the risk. The vulnerability was mitigated in version 1.7.0 when the affected path/file was removed.

Affected Version(s)

OpenHands 0.1

OpenHands 0.2

OpenHands 0.3

References

https://vuldb.com/vuln/386426
vdb-entrytechnical-description
https://vuldb.com/vuln/386426/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-19022
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

edoardottt (VulDB User)
VulDB CNA Team
.