Skip to content
OpenAdvisories
High · 7.6 Public exploit CVE-2026-33718 EUVD-2026-16500GHSA-7h8w-hj9j-8rjwPYSEC-2026-106

OpenHands is Vulnerable to Command Injection through its Git Diff Handler

Published Mar 27, 2026 · Updated Mar 27, 2026 · Assigned by GitHub_M

Vendor: OpenHands Product: OpenHands Package: openhands-ai Ecosystem: PyPI

Description

OpenHands is software for AI-driven development. Starting in version 1.5.0, a Command Injection vulnerability exists in the `get_git_diff()` method at `openhands/runtime/utils/git_handler.py:134`. The `path` parameter from the `/api/conversations/{conversation_id}/git/diff` API endpoint is passed unsanitized to a shell command, allowing authenticated attackers to execute arbitrary commands in the agent sandbox. The user is already allowed to instruct the agent to execute commands, but this bypasses the normal channels. Version 1.5.0 fixes the issue.

Affected products

VendorProductAffectedFixed
OpenHands OpenHands < 1.5.0 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI openhands-ai < 1.5.0 1.5.0 GHSA-7h8w-hj9j-8rjw

References