OpenHuman agent prompt injection enables tool and command execution

The AI assistant can be tricked by an attacker's message into reading files and sending mail!

Summary

Content from external MCP servers, email sync and chat channels can trick the OpenHuman agent into running tools, commands, or leaking data. Versions before 0.57.13 are affected.

Affected when

An attacker-controlled or compromised MCP server configured
An active Composio integration
A Yuanbao channel configured with Node enabled

What to do

Update to 0.57.13 or later.

Products and platforms

OpenHuman

CVE IDs

CVE-2026-54140 (opens in a new tab)
CVE-2026-54141 (opens in a new tab)
CVE-2026-54143 (opens in a new tab)
CVE-2026-54142 (opens in a new tab)

Sources

Write-up: github.com (opens in a new tab) · github.com (opens in a new tab)
CVE record: cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab)

Times

First published 2026-11-05 16:13 UTC

First seen 2026-11-09 17:00 UTC