CVE-2026-54140— OpenHuman: MCP tool description injection: untrusted server descriptions execute in agent LLM context without sanitization

Quick assessment

Affected

tinyhumansai openhuman

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OpenHuman 是一个开源的智能体（Agent）框架，提供桌面应用程序和 Rust 库。在 0.57.13 版本之前，OpenHuman 会将配置的外部 MCP（Model Context Protocol）服务器返回的名称、描述、标题及参数定义直接放入智能体模型的上下文之中，且未对指令进行中和处理，也未对描述性字段进行长度或内容限制。由生成的记录会保留这些来自远程的内容，而工具过滤机制仅检查工具名称，提示注入检测器也仅扫描用户消息，并不检查 MCP 定义本身。因此，恶意或已被攻陷的 MCP 服务器可返回被

CVSS 8.3 · High Updated Nov 06, 2026

Possible ATT&CK Techniques 3 AI

T1059.007 · JavaScript T1068 · Exploitation for Privilege Escalation T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

OpenHuman: MCP tool description injection: untrusted server descriptions execute in agent LLM context without sanitization

Source: CVE Program / CVE List V5

Vulnerability Description

OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.57.13, OpenHuman places names, descriptions, titles, and parameter definitions returned by configured external MCP servers into the agent model context without neutralizing instructions or bounding the descriptive fields. The McpRemoteTool records produced by list_tools preserve this remote content, while tool filtering considers the tool name and the prompt-injection detector screens user messages rather than MCP definitions. A malicious or compromised MCP server can therefore return a poisoned description that is evaluated on every agent turn and may direct the model to invoke other available tools, disclose accessible data, or perform unauthorized actions without a separate malicious user message. The issue affects users who configure an attacker-controlled or compromised MCP server. This issue is fixed in version 0.57.13.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

CWE-1427

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
tinyhumansai	openhuman	< 0.57.13	-

II. Public POCs for CVE-2026-54140

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-54140

请登录查看更多情报信息。

Other References for CVE-2026-54140 (4)

https://github.com/tinyhumansai/openhuman/pull/3215 x_refsource_MISC
https://github.com/tinyhumansai/openhuman/releases/tag/v0.57.13 x_refsource_MISC
https://github.com/tinyhumansai/openhuman/security/advisories/GHSA-g6j9-89xv-v752 x_refsource_CONFIRM
https://github.com/tinyhumansai/openhuman/commit/00b8a669c6e6391a1be9f724bd9c8f755ee3c43e x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-54140

Same Patch Batch · tinyhumansai · 2026-11-05 · 10 CVEs total

CVE-2026-54143	9.8 CRITICAL	OpenHuman allows remote inbound channel messages to create unapproved shell cron jobs lead
CVE-2026-54141	9.0 CRITICAL	OpenHuman: Yuanbao non-web channel can bypass human approval to execute `node_exec`
CVE-2026-54145	8.8 HIGH	OpenHuman: Bearer token leaked via approval gate session_id (SQLite plaintext + debug log
CVE-2026-54146	8.8 HIGH	OpenHuman: Bearer token leak via process environment variable on macOS (same-UID local RCE
CVE-2026-54142	8.7 HIGH	OpenHuman: Indirect prompt injection via background email sync executes Composio actions w
CVE-2026-49393	8.4 HIGH	OpenHuman: Unauthenticated Socket.IO RPC bypass allows invoking protected OpenHuman core c
CVE-2026-49407	7.7 HIGH	OpenHuman: Unauthenticated dictation WebSocket allows arbitrary audio streaming and unboun
CVE-2026-49405	6.2 MEDIUM	OpenHuman: Unauthenticated server-sent events endpoint leaks user-facing event data
CVE-2026-54144	6.1 MEDIUM	OpenHuman: Embedded Google Meet webview can silently capture the macOS desktop without a u

IV. Related Vulnerabilities

Same product: openhuman

Same vendor: tinyhumansai

Same weakness: CWE-1427