CVE-2026-55743
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk50th percentile - higher than 50% of all known CVEs
Summary
The shell tool command allowlist in the SecurityPolicy of OpenHuman desktop agent through 0.54.0 (default Supervised security policy) can be bypassed to execute arbitrary OS commands with the privileges of the desktop user.
Risk Assessment
Risk of malicious command execution on the user's machine, potentially leading to data theft, malware installation, or system compromise.
Recommendation
Update OpenHuman to a version newer than 0.54.0. Additionally, restrict agent privileges and monitor its activity for suspicious behavior.
Original NVD description (English source)
The shell tool command allowlist in the SecurityPolicy of OpenHuman desktop agent through 0.54.0 (default Supervised security policy) can be bypassed to execute arbitrary OS commands with the privileges of the desktop user.