CVE-2026-54141— OpenHuman: Yuanbao non-web channel can bypass human approval to execute `node_exec`

Quick assessment

Affected

tinyhumansai openhuman

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OpenHuman 是一个开源的智能体（Agent）框架，提供桌面应用程序和 Rust 库形式。在 0.57.13 版本之前，通过已配置的 Yuanbao 频道接收的远程直接消息会被转换为通用的频道 AgentTurnRequest，该请求使用默认工具策略，但并未建立交互式审批上下文。在默认启用的“受监督自主”（Supervised autonomy）策略且 Node 功能开启的情况下，node_exec 被归类为需要提示审批的写入操作；然而，ApprovalGate 将缺失的 APPROVAL_CHAT_CONT

CVSS 9.0 · Critical Updated Nov 06, 2026

Possible ATT&CK Techniques 3 AI

T1059 · Command and Scripting Interpreter T1055 · Process Injection T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

OpenHuman: Yuanbao non-web channel can bypass human approval to execute `node_exec`

Source: CVE Program / CVE List V5

Vulnerability Description

OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.57.13, a remote direct message received through a configured Yuanbao channel is converted into a generic channel AgentTurnRequest that uses the default tool policy without establishing an interactive approval context. Under the default Supervised autonomy policy with Node enabled, node_exec is classified as a write operation that should prompt for approval, but ApprovalGate treats missing APPROVAL_CHAT_CONTEXT as a non-interactive turn and allows execution. Because Yuanbao direct messages are open by default, an external sender who can message the connected bot can influence the agent to execute JavaScript and operating-system commands as the OpenHuman user without an approval prompt. The issue requires a configured Yuanbao channel, the default approval-requiring policy state, Node availability, and successful model selection of node_exec. This issue is fixed in version 0.57.13.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

对生成代码的控制不恰当(代码注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
tinyhumansai	openhuman	< 0.57.13	-

II. Public POCs for CVE-2026-54141

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-54141

请登录查看更多情报信息。

Other References for CVE-2026-54141 (4)

https://github.com/tinyhumansai/openhuman/pull/3227 x_refsource_MISC
https://github.com/tinyhumansai/openhuman/releases/tag/v0.57.13 x_refsource_MISC
https://github.com/tinyhumansai/openhuman/security/advisories/GHSA-gg3m-wgmq-vhmx x_refsource_CONFIRM
https://github.com/tinyhumansai/openhuman/commit/3a7180da7765af861bf44d79e025fc67dbeae0ca x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-54141

Same Patch Batch · tinyhumansai · 2026-11-05 · 10 CVEs total

CVE-2026-54143	9.8 CRITICAL	OpenHuman allows remote inbound channel messages to create unapproved shell cron jobs lead
CVE-2026-54145	8.8 HIGH	OpenHuman: Bearer token leaked via approval gate session_id (SQLite plaintext + debug log
CVE-2026-54146	8.8 HIGH	OpenHuman: Bearer token leak via process environment variable on macOS (same-UID local RCE
CVE-2026-54142	8.7 HIGH	OpenHuman: Indirect prompt injection via background email sync executes Composio actions w
CVE-2026-49393	8.4 HIGH	OpenHuman: Unauthenticated Socket.IO RPC bypass allows invoking protected OpenHuman core c
CVE-2026-54140	8.3 HIGH	OpenHuman: MCP tool description injection: untrusted server descriptions execute in agent
CVE-2026-49407	7.7 HIGH	OpenHuman: Unauthenticated dictation WebSocket allows arbitrary audio streaming and unboun
CVE-2026-49405	6.2 MEDIUM	OpenHuman: Unauthenticated server-sent events endpoint leaks user-facing event data
CVE-2026-54144	6.1 MEDIUM	OpenHuman: Embedded Google Meet webview can silently capture the macOS desktop without a u

IV. Related Vulnerabilities

Same product: openhuman

Same vendor: tinyhumansai

Same weakness: CWE-94