Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| openhands-ai | pip | >= 0, < 1.5.0 | 1.5.0 |
Miggo AIRoot Cause AnalysisThe analysis of the security advisory and the associated patch (PR #13051, commit b50250433f9bac889e660172d877da5b1ac7e2a7) reveals a command injection vulnerability. The root cause is the lack of input sanitization on the path parameter received by the /api/conversations/{conversation_id}/git/diff API endpoint. This unsanitized input is passed down through multiple functions until it reaches two key sinks where shell commands are constructed and executed.
The first vulnerable function, GitHandler.get_git_diff in openhands/runtime/utils/git_handler.py, directly uses the user-provided file_path in a string format operation to build a command that is later executed with shell=True. The patch confirms this by adding shlex.quote() to sanitize the input.
The second vulnerable function, get_git_diff in openhands/runtime/utils/git_diff.py, is executed as a helper script. It also constructs a shell command (git show) using the file path, which was also unsanitized. The patch applies shlex.quote() here as well.
An attacker could exploit this by crafting a malicious path parameter (e.g., "; id #) to execute arbitrary commands within the agent's sandbox, leading to remote code execution.
