Executive Summary

This vulnerability exists in the shell tool command allowlist of the OpenHuman desktop agent's SecurityPolicy up to version 0.54.0. It allows attackers to bypass restrictions and execute arbitrary operating system commands with the privileges of the desktop user.

The issue arises from two combined flaws: first, the function is_args_safe() blocks certain dangerous find command flags (-exec and -ok) but does not block their functionally identical counterparts (-execdir and -okdir), which also execute arbitrary commands. Second, skip_env_assignments() removes leading inline environment variable assignments before validating commands against the allowlist, enabling attackers to inject malicious commands through environment-driven hooks like GIT_EXTERNAL_DIFF.

Because the sandbox is the main trust boundary between untrusted content processed by large language models and the host OS, an attacker can use indirect prompt injection via malicious documents, emails, calendar events, or web pages to run seemingly benign allowlisted commands that actually execute arbitrary commands, leading to remote code execution.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including arbitrary command execution with the user's desktop privileges, which can lead to data exfiltration, unauthorized reading and writing of files, and lateral movement within the user's machine.

An attacker can exploit this flaw remotely by tricking the OpenHuman agent into running malicious commands embedded in seemingly harmless allowlisted commands, potentially compromising the entire system and sensitive data.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves identifying if the OpenHuman desktop agent is running a vulnerable version (through 0.54.0) and if it is executing allowlisted shell commands that could be bypassed using the flawed validation of find command flags (-execdir, -okdir) or environment variable assignments (e.g., GIT_EXTERNAL_DIFF).

You can check the version of the OpenHuman agent installed on your system to see if it is prior to 0.54.22-staging or 0.56.0 where the fix was applied.

To detect exploitation attempts, monitor command executions involving the find command with -execdir or -okdir flags, or commands that use environment variable prefixes like GIT_EXTERNAL_DIFF or GIT_SSH_COMMAND that could be used to inject arbitrary commands.

Suggested commands to help detect suspicious activity include:

• Check OpenHuman version: `openhuman --version` or check installed package version.
• Search running processes for suspicious find commands: `ps aux | grep 'find .* -execdir'` or `ps aux | grep 'find .* -okdir'`.
• Audit shell command history for usage of find with -execdir/-okdir or environment variable assignments preceding allowlisted commands, e.g., `grep -E 'find .* (-execdir|-okdir)' ~/.bash_history`.
• Monitor environment variables used in commands, especially those like GIT_EXTERNAL_DIFF or GIT_SSH_COMMAND, for suspicious inline assignments.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade the OpenHuman desktop agent to version 0.56.0 or later, where the vulnerability has been fixed by blocking the dangerous find command flags (-execdir, -okdir) and tightening validation of environment variable prefixes in commands.

If immediate upgrade is not possible, consider restricting or monitoring the use of the find command with -execdir and -okdir flags and disallowing inline environment variable assignments that could lead to command injection.

Additionally, review and tighten security policies around the execution of shell commands by the OpenHuman agent, especially under the Supervised security policy.

Implement network and host monitoring to detect suspicious command executions and potential exploitation attempts.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows arbitrary command execution with the privileges of the desktop user, leading to potential data exfiltration, arbitrary file read/write, and lateral movement on the user's machine.

Such unauthorized access and data manipulation could compromise the confidentiality and integrity of sensitive personal or health data, thereby impacting compliance with regulations like GDPR and HIPAA that require strict controls on data protection and breach prevention.

Because the sandbox is the primary trust boundary between untrusted content and the host OS, this bypass undermines security assumptions critical for regulatory compliance.

Useful 0 Not Useful 0