CVE-2026-19022 PUBLISHED

OpenHands send_pull_request.py initialize_repo command injection

Assigner: VulDB
Reserved: 05.08.2026 Published: 06.08.2026 Updated: 06.08.2026

A vulnerability was determined in OpenHands up to 0.62.0. The affected element is the function initialize_repo of the file OpenHands/resolver/send_pull_request.py. This manipulation causes command injection. Remote exploitation of the attack is possible. The vendor deleted the original GitHub issue report. It appears that the affected path/file got removed in version 1.7.0.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
CVSS Score: 5.3

Product Status

Vendor n/a
Product OpenHands
Versions
  • Version 0.1 is affected
  • Version 0.2 is affected
  • Version 0.3 is affected
  • Version 0.4 is affected
  • Version 0.5 is affected
  • Version 0.6 is affected
  • Version 0.7 is affected
  • Version 0.8 is affected
  • Version 0.9 is affected
  • Version 0.10 is affected
  • Version 0.11 is affected
  • Version 0.12 is affected
  • Version 0.13 is affected
  • Version 0.14 is affected
  • Version 0.15 is affected
  • Version 0.16 is affected
  • Version 0.17 is affected
  • Version 0.18 is affected
  • Version 0.19 is affected
  • Version 0.20 is affected
  • Version 0.21 is affected
  • Version 0.22 is affected
  • Version 0.23 is affected
  • Version 0.24 is affected
  • Version 0.25 is affected
  • Version 0.26 is affected
  • Version 0.27 is affected
  • Version 0.28 is affected
  • Version 0.29 is affected
  • Version 0.30 is affected
  • Version 0.31 is affected
  • Version 0.32 is affected
  • Version 0.33 is affected
  • Version 0.34 is affected
  • Version 0.35 is affected
  • Version 0.36 is affected
  • Version 0.37 is affected
  • Version 0.38 is affected
  • Version 0.39 is affected
  • Version 0.40 is affected
  • Version 0.41 is affected
  • Version 0.42 is affected
  • Version 0.43 is affected
  • Version 0.44 is affected
  • Version 0.45 is affected
  • Version 0.46 is affected
  • Version 0.47 is affected
  • Version 0.48 is affected
  • Version 0.49 is affected
  • Version 0.50 is affected
  • Version 0.51 is affected
  • Version 0.52 is affected
  • Version 0.53 is affected
  • Version 0.54 is affected
  • Version 0.55 is affected
  • Version 0.56 is affected
  • Version 0.57 is affected
  • Version 0.58 is affected
  • Version 0.59 is affected
  • Version 0.60 is affected
  • Version 0.61 is affected
  • Version 0.62.0 is affected

Credits

  • edoardottt (VulDB User) reporter
  • VulDB CNA Team coordinator

References

Problem Types

  • Command Injection CWE
  • Injection CWE