Remote Code Execution Vulnerability in OpenHuman Desktop Application and Rust Library
CVE-2026-54141

9CRITICAL

Key Information:

Vendor

Tinyhumansai

Status
Openhuman
Vendor
CVE Published:
5 November 2026

What is CVE-2026-54141?

The OpenHuman desktop application and Rust library, prior to version 0.57.13, are prone to a remote code execution vulnerability. When a direct message is received through a Yuanbao channel, it is transformed into a generic AgentTurnRequest, which bypasses necessary approval procedures under certain configurations. Specifically, the vulnerability arises when node_exec is identified as a write operation that should require approval but is mistakenly allowed to execute without an interactive context. This oversight enables an external sender with message capabilities to influence the agent's execution of JavaScript and operating system commands as the OpenHuman user, posing considerable security risks. Users are urged to upgrade to version 0.57.13 to mitigate this risk.

Affected Version(s)

openhuman < 0.57.13

References

https://github.com/tinyhumansai/openhuman/security/adviso...
x_refsource_CONFIRM
https://github.com/tinyhumansai/openhuman/pull/3227
x_refsource_MISC
https://github.com/tinyhumansai/openhuman/commit/3a7180da...
x_refsource_MISC

CVSS V3.1

Score:
9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.