CVEs / CVE-2026-33718
CVE-2026-33718
OpenHands is software for AI-driven development. Starting in version 1.5.0, a Command Injection vulnerability exists in the `get_git_diff()` method at `openhands/runtime/utils/git_handler.py:134`. The `path` parameter from the `/api/conversations/{conversation_id}/git/diff` API endpoint is passed unsanitized to a shell command, allowing authenticated attackers to execute arbitrary commands in the agent sandbox. The user is already allowed to instruct the agent to execute commands, but this bypasses the normal channels. Version 1.5.0 fixes the issue.
Affected products · 1
| Product | Versions affected | Fixed in |
|---|---|---|
| openhands | < 1.5.0 | 1.5.0 |
Versions as NVD's CPE configuration states them; "—" means the record gives no fixed version, not that none exists. Check the vendor's advisory in the references.
In this registry
- OpenHands — agent dossier
References · 4
- docs.python.org/3/library/shlex.html#shlex.quote — Technical Description
- docs.python.org/3/library/subprocess.html#security-considerations — Technical Description
- github.com/OpenHands/OpenHands/pull/13051 — Issue Tracking, Patch
- owasp.org/www-community/attacks/Command_Injection — Technical Description
The official record's references, as NVD lists them, minus any tagged Exploit. Nothing here is an exploit or a proof of concept.
Description, scores, versions and references are the official CVE record's own, retrieved 2026-10-25 from NVD. Category, attack surface and cross-links are this registry's classification and can be wrong — use the button above. Not a severity assessment for your deployment.