CVE-2026-54142— OpenHuman: Indirect prompt injection via background email sync executes Composio actions without user approval

Quick assessment

Affected

tinyhumansai openhuman

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OpenHuman 是一个开源的智能体（Agent）框架，提供桌面应用程序和 Rust 库。在 0.57.13 版本之前，针对已连接的服务（如电子邮件、Slack 和 Notion）执行的后台同步功能会存储原始的外部内容，随后将其直接放入自主后台智能体的模型上下文中，而未对其中嵌入的指令进行中和处理。由于 ApprovalGate 将缺乏交互式聊天上下文背景的工具调用视为“已预先授权的自动化操作”，攻击者撰写的、在后台同步周期内处理的内容可能诱导模型调用 Composio 动作，而无需弹出任何审批请求。若攻击者能够

CVSS 8.7 · High Updated Nov 06, 2026

Possible ATT&CK Techniques 3 AI

T1055 · Process Injection T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

OpenHuman: Indirect prompt injection via background email sync executes Composio actions without user approval

Source: CVE Program / CVE List V5

Vulnerability Description

OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.57.13, background synchronization for connected services such as email, Slack, and Notion stores raw external content and later places it in the model context of autonomous background agents without neutralizing embedded instructions. ApprovalGate treats tool calls without an interactive chat context as pre-authorized automation, so attacker-authored content processed during a background tick can influence the model to invoke Composio actions without presenting an approval request. An attacker who can deliver content to a connected account can use this path to send or forward data, post messages, create or modify third-party content, or disclose information from OpenHuman memory and integrations. The issue requires an active integration and successful model interpretation of the injected instructions. This issue is fixed in version 0.57.13.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

CWE-1427

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
tinyhumansai	openhuman	< 0.57.13	-

II. Public POCs for CVE-2026-54142

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-54142

请登录查看更多情报信息。

Other References for CVE-2026-54142 (4)

https://github.com/tinyhumansai/openhuman/pull/3227 x_refsource_MISC
https://github.com/tinyhumansai/openhuman/releases/tag/v0.57.13 x_refsource_MISC
https://github.com/tinyhumansai/openhuman/security/advisories/GHSA-p9gw-q7cf-57qr x_refsource_CONFIRM
https://github.com/tinyhumansai/openhuman/commit/3a7180da7765af861bf44d79e025fc67dbeae0ca x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-54142

Same Patch Batch · tinyhumansai · 2026-11-05 · 10 CVEs total

CVE-2026-54143	9.8 CRITICAL	OpenHuman allows remote inbound channel messages to create unapproved shell cron jobs lead
CVE-2026-54141	9.0 CRITICAL	OpenHuman: Yuanbao non-web channel can bypass human approval to execute `node_exec`
CVE-2026-54145	8.8 HIGH	OpenHuman: Bearer token leaked via approval gate session_id (SQLite plaintext + debug log
CVE-2026-54146	8.8 HIGH	OpenHuman: Bearer token leak via process environment variable on macOS (same-UID local RCE
CVE-2026-49393	8.4 HIGH	OpenHuman: Unauthenticated Socket.IO RPC bypass allows invoking protected OpenHuman core c
CVE-2026-54140	8.3 HIGH	OpenHuman: MCP tool description injection: untrusted server descriptions execute in agent
CVE-2026-49407	7.7 HIGH	OpenHuman: Unauthenticated dictation WebSocket allows arbitrary audio streaming and unboun
CVE-2026-49405	6.2 MEDIUM	OpenHuman: Unauthenticated server-sent events endpoint leaks user-facing event data
CVE-2026-54144	6.1 MEDIUM	OpenHuman: Embedded Google Meet webview can silently capture the macOS desktop without a u

IV. Related Vulnerabilities

Same product: openhuman

Same vendor: tinyhumansai

Same weakness: CWE-1427