CVE-2026-19022

CVE-2026-19022 is a command injection vulnerability in OpenHands' `initialize_repo` function, present in versions up to 0.62.0. The vulnerable code accepts repository URLs, branch names, or remote references and passes them to shell execution contexts without adequate sanitization. The CVSS of 6.3 reflects the precondition that an attacker needs to control the repository data the tool processes—but for a tool whose core function is processing external pull requests and repositories, that's a routine operational state, not an exceptional barrier. The fix appeared in version 1.7.0, and the remediation was deleting the entire module and rewriting it rather than patching the specific vulnerability. That pattern matters: it suggests the original implementation had systemic trust-in-external-input patterns throughout, not a single sanitization oversight. For defenders: First, verify your OpenHands version—if you're on anything below 1.7.0 and processing external repositories, you're vulnerable. Second, treat any AI coding agent that executes shell commands as having an elevated blast radius: the compromise of such a tool doesn't just affect the tool itself, but potentially the commit history of every repository it touched. Third, audit what repository data your agent can access and consider reducing its git credentials to read-only where possible—the injection surface exists because the tool needs elevated access to function, so reducing that access reduces the consequence of exploitation even if you can't eliminate the surface. The broader pattern here is worth internalizing. AI coding agents must execute shell commands, interact with git, and manipulate filesystems to function—each is an injection surface. This isn't unique to OpenHands. Any agent with similar operational patterns carries latent command injection risk until proven otherwise through code audit or time.

Reviewed through automated stages and approved by a human before publication.