CVE-2026-33718

OpenHands is software for AI-driven development. Starting in version 1.5.0, a Command Injection vulnerability exists in the getgitdiff method at openhands/runtime/utils/githandler.py:134. The path parameter from the /api/conversations/conversationid/git/diff API endpoint is passed unsanitized to ...

CVE-2026-33718

OpenHands CVE-2026-33718 is a command-injection vulnerability disclosed across multiple feeds. It affects the get_git_diff() path in OpenHands 1.5.0 and earlier when the path parameter from the /api/conversations/{conversation_id}/git/diff endpoint is unsafely interpolated into a shell command (g...

GHSA-7H8W-HJ9J-8RJW OpenHands is Vulnerable to Command Injection through its Git Diff Handler

Summary A Command Injection vulnerability exists in the getgitdiff method at openhands/runtime/utils/githandler.py:134. The path parameter from the /api/conversations/conversationid/git/diff API endpoint is passed unsanitized to a shell command, allowing authenticated attackers to execute arbitra...