---
id: "CVE-2026-54143"
kind: "vulnerability"
aliases: ["CVE-2026-54143"]
title: "OpenHuman agent harness lets chat messages schedule persistent shell commands"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-agents", "ai-tooling", "desktop", "openhuman", "rust"]
not_affected_if: ["no-external-channel", "version-0.57.13-or-later"]
published_at: "2026-11-05T17:18:19+00:00"
first_seen_at: "2026-11-05T17:40:04+00:00"
updated_at: "2026-11-05T17:42:04+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54143", "first_seen_at": "2026-11-05T17:40:04+00:00"}]
exploit_sources: []
---

# OpenHuman agent harness lets chat messages schedule persistent shell commands

OpenHuman is an open-source agent harness that runs as a desktop app and Rust library. Before 0.57.13, a message sent through a configured external channel can make the agent create cron jobs that run shell commands as the OpenHuman user, without human approval.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed OpenHuman version against `0.57.13`.
- Review whether external messaging channels are configured for the agent.
- Look for unexpected persistent cron jobs created by the OpenHuman runtime user.

## Fix

- Upgrade OpenHuman to `0.57.13` or later.

## Timeline

- 2026-11-05T17:40:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-54143

## Documents

- [advisory] Vendor advisory: github.com https://github.com/tinyhumansai/openhuman/security/advisories/GHSA-f46p-6vf9-64mm
- [fix] Patch: github.com https://github.com/tinyhumansai/openhuman/commit/3a7180da7765af861bf44d79e025fc67dbeae0ca
- [fix] Patch: github.com https://github.com/tinyhumansai/openhuman/commit/4d9fe2072fdd5787023bafa2c7a63b6f8a7e9b93
- [fix] Release notes: github.com https://github.com/tinyhumansai/openhuman/releases/tag/v0.57.13

## From the sources

OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before version 0.57.13, an attacker who can send messages to a configured external channel can cause the agent to create persistent shell cron jobs without human approval. The scheduler later executes these jobs with the privileges of the OpenHuman runtime user. Command validation also permits leading environment assignments that can redirect allowed commands to executable helpers. The demonstrated exploit requires a suitable helper executable already present on the host. This can lead to unauthorized persistent command execution and compromise data and resources accessible to OpenHuman. This issue is fixed in version 0.57.13.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_