Threats affecting pkg:github/openhands/OpenHands

CVE-2026-122236 is a vulnerability in OpenHands up to version 1.24.0 affecting the Landing Page component. It allows missing authentication due to a flaw exploitable from within the local network. Public exploit details have been disclosed. The issue is fixed in OpenHands version 1.25.0.

CVE-2026-19022 is a command injection vulnerability in OpenHands versions up to 0.62.0. It affects the function initialize_repo in the file OpenHands/resolver/send_pull_request.py. The vulnerable code path was removed in version 1.7.0. Remote exploitation is possible, allowing an attacker to execute arbitrary commands. The vulnerability has a medium severity with a CVSS score of 5.3. No official patch or remediation guidance is currently confirmed from the vendor.