The vulnerability in OpenHuman desktop agent (<=0.54.0) stems from two combined flaws in the SecurityPolicy shell tool command allowlist: (1) the is_args_safe() function blocks the find command flags -exec and -ok but not the functionally equivalent -execdir and -okdir, which also execute arbitrary commands; (2) skip_env_assignments() removes leading inline environment variable assignments before allowlist validation, allowing commands like GIT_EXTERNAL_DIFF=<cmd> git diff to bypass checks and execute arbitrary commands via git's environment-driven hooks. Because the sandbox is the main trust boundary between untrusted LLM-processed content and the host OS, an attacker can achieve remote code execution by tricking the agent into running seemingly benign allowlisted commands that execute arbitrary OS commands, enabling data exfiltration, file manipulation, and lateral movement. The vulnerability was fixed in commit 60050aa09a870f53ed7e4cd40ed41fd2860329e7, first released in 0.54.22-staging and stable in 0.56.0, by blocking the -execdir and -okdir flags in find.

Successful exploitation allows remote code execution with the privileges of the desktop user running the OpenHuman agent. This can lead to arbitrary command execution, data exfiltration, arbitrary file read/write operations, and lateral movement on the affected machine. The vulnerability undermines the sandbox trust boundary, enabling attackers to leverage indirect prompt injection via malicious documents, emails, calendar events, or web pages processed by the agent.

A patch is available and was released in OpenHuman version 0.56.0 (and earlier in 0.54.22-staging) that blocks the -execdir and -okdir flags in the find command to prevent bypass of the shell tool command allowlist. Users should upgrade to version 0.56.0 or later to remediate this vulnerability. Since this is a cloud service, the vendor manages remediation for the cloud-hosted components; users should verify with the vendor that their environment is updated accordingly.