CVE-2026-19022 describes a command injection vulnerability in OpenHands versions up to 0.62.0. The flaw resides in the initialize_repo function of the OpenHands/resolver/send_pull_request.py file, enabling remote attackers with low privileges to execute arbitrary commands. The vendor removed the affected code path in version 1.7.0, effectively addressing the vulnerability. There is no explicit vendor advisory or patch link available, and the original GitHub issue report was deleted. The CVSS v3.1 base score is 6.3 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

The vulnerability allows remote attackers with limited privileges to perform command injection, potentially leading to unauthorized command execution. This can impact confidentiality, integrity, and availability of the affected system. However, there are no known exploits in the wild reported. The affected code was removed in version 1.7.0, which mitigates the vulnerability.

Upgrade OpenHands to version 1.7.0 or later, where the vulnerable code path has been removed. Since no official patch or advisory is provided, this upgrade is the recommended remediation. Monitor vendor channels for any future advisories or patches. No additional mitigation actions are specified by the vendor.