Input Validation Flaw in OpenHuman Desktop Application by Tiny Humans AI
CVE-2026-54140
What is CVE-2026-54140?
The OpenHuman desktop application is susceptible to an input validation flaw that allows malicious or compromised external MCP servers to inject harmful instructions. Prior to version 0.57.13, the application failed to appropriately neutralize names, descriptions, titles, and parameter definitions retrieved from these servers, leading to potential misuse of features and unauthorized actions. As a result, a compromised MCP server can deliver tainted descriptions that the application evaluates, which could trigger the execution of unintended commands, disclose sensitive data, or prompt other tools hosted within the agent framework, all without explicit malicious user interaction. Users must upgrade to version 0.57.13 to mitigate these risks.
Affected Version(s)
openhuman < 0.57.13