CVE-2026-55743: OpenHuman desktop agent shell tool sandbox bypass leads to arbitrary command execution

Synopsis

A sandbox bypass vulnerability in the OpenHuman desktop agent (versions through 0.54.0) allows an attacker to execute arbitrary operating system commands with the privileges of the logged-in desktop user. The vulnerability is reachable over the network via indirect prompt injection: malicious content in a document, email, calendar event, or web page ingested by the agent can instruct it to run a crafted allowlisted command that bypasses the shell tool sandbox. Successful exploitation gives an attacker full remote code execution on the host, including data exfiltration, arbitrary file read/write, and lateral movement. No stable fix version has been published at the time of this record; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attack path requires the agent to ingest content from an attacker-controlled network source (document, email, calendar event, or web page), so the agent must be reachable to or reachable from external network content.

• AuthenticationNot required

  No credentials or account on the target system are required; the attacker delivers the payload passively through content the agent fetches or processes.

• Victim interactionRequired

  The desktop user must take an action that causes the agent to ingest attacker-controlled content, such as opening a document, loading an email, or visiting a web page that carries the prompt-injection payload.

• Attack complexityDetail

  Exploitation is reliable and condition-free once the agent processes the malicious content; no race conditions, memory-layout dependencies, or special environmental factors are needed.

Blast Radius

• Reads arbitrary files on the host filesystem, including credentials, private keys, browser session tokens, and personal documents accessible to the desktop user.
• Writes or overwrites arbitrary files on the host filesystem, enabling persistence mechanisms or corruption of user data.
• Executes arbitrary OS commands with desktop-user privileges, allowing installation of malware or other attacker tooling.
• Enables lateral movement from the compromised workstation to other systems reachable on the same network using credentials or keys harvested from the host.