HighVulnerability
CVE-2026-33718: OpenHands command injection in git diff endpoint path parameter
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-33718
- Published
- Record updated
- Affected
- openhands-ai >= 0, < 1.5.0
- Fixed in
- 1.5.0
- released March 11, 2026, 16 days before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 2.0%
Summary
CVE-2026-33718 affects OpenHands starting in version 1.5.0. The `path` parameter of the `/api/conversations/{conversation_id}/git/diff` endpoint is passed unsanitized to a shell command in `get_git_diff()` at `openhands/runtime/utils/git_handler.py:134`. An authenticated attacker can execute arbitrary commands in the agent sandbox, bypassing the normal channels through which the user may already instruct the agent to run commands.
Mitigation
Fixed in 1.5.0.
Related items
- HighCVE-2026-123818: LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0…Similar attack · NVD/CVE Database
- HighGHSA-vvr2-h2jp-838m: Code Graph RAG: MCP paginated read_file path traversal / arbitrary file readSimilar attack · GitHub Advisory Database
- MediumAttackers Crash Claude's 'Office Party' Flaw to Run Malicious Code on LinuxSimilar attack · Dark Reading
- MediumCVE-2026-124588: huggingface finetrainers code injection via Library argumentSimilar attack · NVD/CVE Database
- MediumTaiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch RecordsSimilar attack · The Hacker News