CVE-2026-33718: OpenHands is software for AI-driven development. Starting in version 1.5.0, a Command Injection vulnerability exists in

OpenHands, a software tool for AI-driven development, has a command injection vulnerability (a security flaw where untrusted input is directly executed as commands) in versions 1.5.0 and later. The vulnerability exists in the git handling code, where user input is passed directly to shell commands without filtering, allowing authenticated attackers to run arbitrary commands in the agent's sandbox environment, bypassing the normal oversight channels.