External risk intelligence

OpenClaude Command Injection Vulnerability Allows Host-Level Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-42074

OpenClaude is a command line interface tool intended for local or developer-focused usage. It functions as a development utility rather than an internet-facing service, gateway, or public-facing network appliance, making internet-based exploitation in common deployments very unlikely.

Missing Authentication

Gitlawb Openclaude

before 0.5.1

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

The OpenClaude command-line interface, prior to version 0.5.1, has a vulnerability that could allow an untrusted model to execute arbitrary commands on the host system. This occurs when a prompt-injected model is able to disable security sandboxing, bypassing intended limitations. This issue highlights the importance of carefully managing inputs from models, especially when they can influence system-level operations.

Untrusted models could run any command.
Potential for unauthorized system access.
Confirm relevance and exposure of this tool.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this by tricking the coding agent into setting a specific parameter, which, if the system has a default configuration, would allow the agent to bypass its security sandbox and run arbitrary commands on the host system.

No specific entry conditions.
LLM-controlled parameter.
Full host code execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, this vulnerability could allow a malicious, prompt-injected model to execute arbitrary commands on the host system, potentially affecting system data and service behavior.

Host system data and commands at risk.
Model can be prompted to inject commands.
Full host-level code execution possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for managing developer tools and the underlying infrastructure where these agents execute should prioritize this vulnerability. The first practical step is to identify all instances of OpenClaude, confirm their reachability and criticality, and then coordinate with the accountable owner for remediation, likely involving the development or platform engineering teams.

Ownership lies with developer tool or platform teams.
Verify agent deployment and network exposure.
Plan for code execution risk reduction.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is OpenClaude?

OpenClaude is an open-source command line interface tool used by developers to integrate coding agents with cloud-based or local artificial intelligence models. It automates tasks by letting an LLM execute shell commands via its BashTool component, acting as an interactive assistant for software development workflows.

Why is CVE-2026-42074 a security risk?

This vulnerability, involving Improper Access Control (CWE-284) and Missing Authentication (CWE-306), occurs because the tool's input schema exposes a sandbox-disabling parameter to the LLM. Because the model is treated as an untrusted entity, its ability to toggle this setting allows it to bypass security boundaries and execute arbitrary commands directly on the host machine.

How does an attacker trigger this sandbox escape?

An attacker triggers this by using prompt injection to manipulate the LLM into setting the 'dangerouslyDisableSandbox' parameter to true. This exploit relies on the default 'allowUnsandboxedCommands' setting being active. Crucially, the vulnerability cannot be triggered unless the agent is configured to permit unsandboxed operations or is successfully instructed to override the sandbox via the model's output.

Is my instance of OpenClaude at risk?

According to Halo Surface Signal, active internet-based exploitation is very unlikely. OpenClaude is designed as a developer-focused utility rather than a public-facing network service or gateway. Users should primarily assess risk based on whether the tool is installed in environments where untrusted models or malicious prompts could interact with it.

How do I secure my environment against this?

The most effective response is to update OpenClaude to version 0.5.1 or later, which patches the input schema flaw. If you manage developer tools, identify all local or server-side installations of this CLI and coordinate with your engineering teams to ensure the latest version is deployed, effectively closing the path for sandbox-bypassing commands.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.