{"id":"CVE-2026-54143","kind":"vulnerability","aliases":["CVE-2026-54143"],"related":[],"title":"OpenHuman agent harness lets chat messages schedule persistent shell commands","description":"OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before version 0.57.13, an attacker who can send messages to a configured external channel can cause the agent to create persistent shell cron jobs without human approval. The scheduler later executes these jobs with the privileges of the OpenHuman runtime user. Command validation also permits leading environment assignments that can redirect allowed commands to executable helpers. The demonstrated exploit requires a suitable helper executable already present on the host. This can lead to unauthorized persistent command execution and compromise data and resources accessible to OpenHuman. This issue is fixed in version 0.57.13.","summary":"OpenHuman is an open-source agent harness that runs as a desktop app and Rust library. Before 0.57.13, a message sent through a configured external channel can make the agent create cron jobs that run shell commands as the OpenHuman user, without human approval.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-agents","ai-tooling","desktop","openhuman","rust"],"not_affected_if":["no-external-channel","version-0.57.13-or-later"],"how_to_check":"- Check the installed OpenHuman version against `0.57.13`.\n- Review whether external messaging channels are configured for the agent.\n- Look for unexpected persistent cron jobs created by the OpenHuman runtime user.","fix":"- Upgrade OpenHuman to `0.57.13` or later.","status":"open","published_at":"2026-11-05T17:18:19+00:00","first_seen_at":"2026-11-05T17:40:04+00:00","triaged_at":"2026-11-05T17:42:04+00:00","updated_at":"2026-11-05T17:42:04+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-11-05T17:42:04Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade OpenHuman to `0.57.13` or later.","reach":"network","title":"OpenHuman agent harness lets chat messages schedule persistent shell commands","impact":"high","summary":"OpenHuman is an open-source agent harness that runs as a desktop app and Rust library. Before 0.57.13, a message sent through a configured external channel can make the agent create cron jobs that run shell commands as the OpenHuman user, without human approval.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["openhuman","ai-agents","rust","desktop"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker runs persistent shell commands as the OpenHuman runtime user","analyst_note":"Confirm which external channels are affected and whether the fix is only in the 0.57.13 release notes linked from the sources.","how_to_check":"- Check the installed OpenHuman version against `0.57.13`.\n- Review whether external messaging channels are configured for the agent.\n- Look for unexpected persistent cron jobs created by the OpenHuman runtime user.","plain_action":"","needs_analyst":true,"not_affected_if":["no-external-channel","version-0.57.13-or-later"],"who_is_affected":"Teams running OpenHuman with an external messaging channel connected to the agent are exposed, because inbound messages can drive the agent's scheduling. Desktop or local-only installs without an external channel are less exposed. The sources do not say which channel types are involved.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000725,"input_tokens":4384,"output_tokens":573,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-54143':13A,16A '0.57.13':44B,89C,178C 'access':169C 'agent':2A,19B,32B,56B,77C,104C 'ai':18B,21B 'ai-ag':17B 'ai-tool':20B 'allow':138C 'alreadi':151C 'also':130C 'app':39B 'applic':83C 'approv':70B,113C 'assign':134C 'attack':91C 'avail':79C 'caus':102C 'channel':52B,100C 'chat':5A 'command':10A,63B,128C,139C,162C 'compromis':165C 'configur':50B,98C 'creat':57B,106C 'cron':58B,109C 'cve':11A,14A 'data':166C 'demonstr':144C 'desktop':23B,38B,82C 'environ':133C 'execut':117C,141C,150C,163C 'exploit':145C 'extern':51B,99C 'fix':175C 'har':3A,33B,78C 'helper':142C,149C 'host':155C 'human':69B,112C 'issu':173C 'job':59B,110C,119C 'later':116C 'lead':132C,158C 'let':4A 'librari':42B,86C 'make':54B 'messag':6A,46B,95C 'open':30B,75C 'open-sourc':29B,74C 'openhuman':1A,24B,26B,66B,71C,125C,171C 'permit':131C 'persist':8A,107C,161C 'present':152C 'privileg':122C 'redirect':137C 'requir':146C 'resourc':168C 'run':35B,61B 'runtim':126C 'rust':25B,41B,85C 'schedul':7A,115C 'send':94C 'sent':47B 'shell':9A,62B,108C 'sourc':31B,76C 'suitabl':148C 'tool':22B 'unauthor':160C 'user':67B,127C 'valid':129C 'version':88C,177C 'without':68B,111C","nicknames":[],"mitigations":[],"who_affected":"Teams running OpenHuman with an external messaging channel connected to the agent are exposed, because inbound messages can drive the agent's scheduling. Desktop or local-only installs without an external channel are less exposed. The sources do not say which channel types are involved.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aiagents","aitooling","critical","desktop","openhuman","rust"],"campaign_type":null,"first_public_at":"2026-10-09T17:35:50+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-54143","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54143","severity":null,"published_at":"2026-11-05T17:18:19+00:00","modified_at":"2026-11-05T17:18:19+00:00","first_seen_at":"2026-11-05T17:40:04+00:00","fetched_at":"2026-11-05T17:40:04+00:00","note":null}],"documents":[{"id":78106,"url":"https://github.com/tinyhumansai/openhuman/commit/3a7180da7765af861bf44d79e025fc67dbeae0ca","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":78113,"url":"https://github.com/tinyhumansai/openhuman/commit/4d9fe2072fdd5787023bafa2c7a63b6f8a7e9b93","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":78104,"url":"https://github.com/tinyhumansai/openhuman/releases/tag/v0.57.13","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":78115,"url":"https://github.com/tinyhumansai/openhuman/security/advisories/GHSA-f46p-6vf9-64mm","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-09T17:35:50+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}