OpenHands 操作系统命令注入漏洞

OpenHands is an open-source AI-driven intelligent agent development platform. Version 1.5.0 of OpenHands contains a vulnerability related to operating system command injection. This vulnerability stems from the getgitdiff method, which allows for command injection, potentially enabling...

CVE-2026-33718: Improper Neutralization of Special Elements used in an OS Command

OpenHands is software for AI-driven development. Starting in version 1.5.0, a Command Injection vulnerability exists in the getgitdiff method at openhands/runtime/utils/githandler.py:134. The path parameter from the /api/conversations/conversationid/git/diff API endpoint is passed unsanitized to ...