Critical severity · published Mar 27, 2026
CVE-2026-33718
OpenHands is Vulnerable to Command Injection through its Git Diff Handler
9.9
CVSS
2%
EPSS
No
On KEV
Description
OpenHands is software for AI-driven development. Starting in version 1.5.0, a Command Injection vulnerability exists in the `get_git_diff()` method at `openhands/runtime/utils/git_handler.py:134`. The `path` parameter from the `/api/conversations/{conversation_id}/git/diff` API endpoint is passed unsanitized to a shell command, allowing authenticated attackers to execute arbitrary commands in the agent sandbox. The user is already allowed to instruct the agent to execute commands, but this bypasses the normal channels. Version 1.5.0 fixes the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
OpenHands · OpenHands
< 1.5.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-33718
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-33718
Technical Description
https://docs.python.org/3/library/shlex.html#shlex.quote
Technical Description
https://docs.python.org/3/library/subprocess.html#security-considerations
Issue Tracking
https://github.com/OpenHands/OpenHands/pull/13051
Exploit
https://github.com/OpenHands/OpenHands/security/advisories/GHSA-7h8w-hj9j-8rjw
Technical Description
https://owasp.org/www-community/attacks/Command_Injection
More from OpenHands
6.3
CVE-2026-19022
OpenHands send_pull_request.py initialize_repo command injection