CVE-2026-19022

MediumCVSS 6.3

Published: 06/08/2026(UTC)Updated: 12/08/2026(UTC)Translated: 06/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.29%

68th percentile - higher than 68% of all known CVEs

Summary

A vulnerability was found in OpenHands up to 0.62.0. The affected function is initialize_repo in OpenHands/resolver/send_pull_request.py, allowing command injection. Remote exploitation is possible. The vendor deleted the original GitHub issue, and the affected file was removed in version 1.7.0.

Risk Assessment

A remote attacker can execute arbitrary commands in the context of the application, potentially leading to system compromise or data breach.

Recommendation

Update OpenHands to version 1.7.0 or later if possible. Otherwise, restrict access to the application and monitor logs for suspicious activity.

Other vulnerabilities in OpenHands

CVE-2026-122236Medium
A vulnerability was found in OpenHands up to 1.24.0 affecting an unknown function of the Landing Page component, leading to missing authentication. The attack must be carried out from within the local network, and the exploit has been publicly disclosed and may be used.

Original NVD description (English source)

A vulnerability was determined in OpenHands up to 0.62.0. The affected element is the function initialize_repo of the file OpenHands/resolver/send_pull_request.py. This manipulation causes command injection. Remote exploitation of the attack is possible. The vendor deleted the original GitHub issue report. It appears that the affected path/file got removed in version 1.7.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS