CVE-2026-55743

CriticalCVSS 9.6

Published: 17/06/2026(UTC)Updated: 26/10/2026(UTC)Translated: 10/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.39%

33th percentile - higher than 33% of all known CVEs

Summary

The shell tool command allowlist in the SecurityPolicy of OpenHuman desktop agent through 0.54.0 (default Supervised security policy) can be bypassed to execute arbitrary OS commands with the privileges of the desktop user.

Risk Assessment

Risk of malicious command execution on the user's machine, potentially leading to data theft, malware installation, or system compromise.

Recommendation

Update OpenHuman to a version newer than 0.54.0. Additionally, restrict agent privileges and monitor its activity for suspicious behavior.

Other vulnerabilities in OpenHuman

CVE-2026-49410High
OpenHuman before 0.56.0 allows cross-site request forgery against the unauthenticated GET /auth/telegram loopback callback. An attacker with an OpenHuman account can cause a user with the local core running to visit a malicious page that requests this endpoint, switching the user's active local session to the attacker's backend account.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS