5.3
Medium
CVE-2026-19022 A vulnerability was determined in OpenHands up to 0.62.0
Description
A vulnerability was determined in OpenHands up to 0.62.0. The affected element is the function initialize_repo of the file OpenHands/resolver/send_pull_request.py. This manipulation causes command injection. Remote exploitation of the attack is possible. The vendor deleted the original GitHub issue report. It appears that the affected path/file got removed in version 1.7.0.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| OpenHands | 0.62.0 | No fix stated |
| OpenHands | 0.61 | No fix stated |
| OpenHands | 0.60 | No fix stated |
| OpenHands | 0.59 | No fix stated |
| OpenHands | 0.58 | No fix stated |
| OpenHands | 0.57 | No fix stated |
| OpenHands | 0.56 | No fix stated |
| OpenHands | 0.55 | No fix stated |
| OpenHands | 0.54 | No fix stated |
Show the 53 other branches Hide the 53 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| OpenHands | 0.53 | No fix stated |
| OpenHands | 0.52 | No fix stated |
| OpenHands | 0.51 | No fix stated |
| OpenHands | 0.50 | No fix stated |
| OpenHands | 0.49 | No fix stated |
| OpenHands | 0.48 | No fix stated |
| OpenHands | 0.47 | No fix stated |
| OpenHands | 0.46 | No fix stated |
| OpenHands | 0.45 | No fix stated |
| OpenHands | 0.44 | No fix stated |
| OpenHands | 0.43 | No fix stated |
| OpenHands | 0.42 | No fix stated |
| OpenHands | 0.41 | No fix stated |
| OpenHands | 0.40 | No fix stated |
| OpenHands | 0.39 | No fix stated |
| OpenHands | 0.38 | No fix stated |
| OpenHands | 0.37 | No fix stated |
| OpenHands | 0.36 | No fix stated |
| OpenHands | 0.35 | No fix stated |
| OpenHands | 0.34 | No fix stated |
| OpenHands | 0.33 | No fix stated |
| OpenHands | 0.32 | No fix stated |
| OpenHands | 0.31 | No fix stated |
| OpenHands | 0.30 | No fix stated |
| OpenHands | 0.29 | No fix stated |
| OpenHands | 0.28 | No fix stated |
| OpenHands | 0.27 | No fix stated |
| OpenHands | 0.26 | No fix stated |
| OpenHands | 0.25 | No fix stated |
| OpenHands | 0.24 | No fix stated |
| OpenHands | 0.23 | No fix stated |
| OpenHands | 0.22 | No fix stated |
| OpenHands | 0.21 | No fix stated |
| OpenHands | 0.20 | No fix stated |
| OpenHands | 0.19 | No fix stated |
| OpenHands | 0.18 | No fix stated |
| OpenHands | 0.17 | No fix stated |
| OpenHands | 0.16 | No fix stated |
| OpenHands | 0.15 | No fix stated |
| OpenHands | 0.14 | No fix stated |
| OpenHands | 0.13 | No fix stated |
| OpenHands | 0.12 | No fix stated |
| OpenHands | 0.11 | No fix stated |
| OpenHands | 0.10 | No fix stated |
| OpenHands | 0.9 | No fix stated |
| OpenHands | 0.8 | No fix stated |
| OpenHands | 0.7 | No fix stated |
| OpenHands | 0.6 | No fix stated |
| OpenHands | 0.5 | No fix stated |
| OpenHands | 0.4 | No fix stated |
| OpenHands | 0.3 | No fix stated |
| OpenHands | 0.2 | No fix stated |
| OpenHands | 0.1 | No fix stated |