RCE in Openhands
CVE-2026-33718
OpenHands is software for AI-driven development. Starting in version 1.5.0, a Command Injection vulnerability exists in the `get_git_diff()` method at `openhands/runtime/utils/git_handler.py:134`. The `path` parameter from the `/api/conversations/{conversation_id}/git/diff` API endpoint is passed unsanitized to a shell command, allowing authenticated attackers to execute arbitrary commands in the agent sandbox. The user is already allowed to instruct the agent to execute commands, but this bypasses the normal channels. Version 1.5.0 fixes the issue.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.019 (77.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L.
Affected products
- Openhands — versions < 1.5.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Mitigation, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC, Issue Tracking)
- security-advisories@github.com (Technical Description, x_refsource_MISC)
- security-advisories@github.com (Technical Description, x_refsource_MISC)
- security-advisories@github.com (Technical Description, x_refsource_MISC)
Frequently asked questions
- What is CVE-2026-33718?
- CVE-2026-33718 is a high-severity vulnerability in Openhands, classified under OS Command Injection. CVSS score: 7.6/10. Published 2026-03-27.
- How severe is CVE-2026-33718?
- High severity. CVSS v3 base score is 7.6 out of 10.
- Is CVE-2026-33718 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.