External risk intelligence

OpenHuman Yuanbao Remote Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2026-54141

OpenHuman is primarily a desktop application and developer library. While it can connect to messaging channels, these are typically integrated into user-side workflows rather than serving as public-facing internet services. Exposure requires a specific third-party channel configuration, making broad public-internet reachability for the vulnerable component uncommon in typical deployments.

Code Injection

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the OpenHuman agent harness, specifically before version 0.57.13, could allow an external sender to execute arbitrary code on a user's system. This occurs when a direct message is received through a configured Yuanbao channel, bypassing the intended approval process for certain operations. The issue requires a specific configuration and interaction to be exploited, meaning the potential impact depends heavily on how OpenHuman is deployed and used.

Malicious messages can run commands without permission.
It impacts systems using OpenHuman with Yuanbao.
Confirm relevance and exposure to managed agents.

Attack Path

How an attacker could exploit the issue

An attacker can compromise an OpenHuman agent by sending a specially crafted direct message through a configured Yuanbao channel. This message bypasses the agent's usual approval process, allowing the attacker to execute arbitrary JavaScript and operating-system commands as the agent's user. This is possible because the agent incorrectly handles certain incoming messages, treating them as non-interactive and thus not requiring user confirmation before execution.

Requires a configured Yuanbao channel.
Triggered by a remote direct message.
Risk of arbitrary command execution.

Live Threat

Current exploitation, exposure, and threat context

An external sender could influence the agent to execute JavaScript and operating-system commands as the OpenHuman user without an approval prompt. This could occur when a Yuanbao channel is configured, the default approval-requiring policy is active, Node is available, and the model selects node_exec.

Operating system commands and JavaScript.
Via direct messages on a configured Yuanbao channel.
Unauthorized code execution and system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and platform teams are likely responsible for addressing this vulnerability, as it affects the OpenHuman agent harness. The first practical move is to identify all instances of OpenHuman, determine their reachability and criticality, and confirm the accountable owner for each instance before planning remediation based on risk.

Ownership: Application owners and platform teams.
Verify first: Identify all OpenHuman instances.
Action: Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the OpenHuman software?

OpenHuman is an open-source agent harness designed to help developers build autonomous agents. It functions as both a standalone desktop application and a Rust library, allowing users to integrate AI-driven task execution into various workflows by connecting to external messaging channels and tools.

What does CVE-2026-54141 mean for security?

This vulnerability involves Improper Control of Generation of Code and Missing Authorization. It essentially means the agent's security gate fails to recognize when it needs to ask the user for permission. As a result, the system mistakenly treats potentially dangerous incoming commands as trusted, allowing them to run without the required interactive approval.

How does an attacker trigger this vulnerability?

An attacker sends a specific direct message through a connected Yuanbao channel. This only succeeds if your agent is using the default supervised policy with Node enabled and the model selects the node_exec function. Simply having the software installed does not trigger the bug; the specific messaging channel must be actively configured and receiving messages.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal indicates that exploitation is unlikely for most users. Because OpenHuman is generally a desktop or library tool rather than a public-facing internet service, it lacks broad external reach. Your risk depends on whether you have specifically configured a third-party Yuanbao channel that accepts messages from the public internet.

What should I do if I use OpenHuman?

The most effective step is to update your software to version 0.57.13 or later. Before applying the update, verify where you have OpenHuman installed and check your current channel configurations to see if Yuanbao is enabled. Once identified, prioritize patching any instances that are actively connected to external messaging services.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.