OpenHuman screen capture and local server flaws
Screens and chats in this AI assistant app can be stolen.
Summary
Several flaws in the OpenHuman desktop app let an attacker capture the screen, read assistant messages and tool output, or call protected functions without a login, and may stop services. Versions before 0.56.0 are affected.
Affected when
- macOS with Screen Recording permission granted (screen capture flaw only)
- OpenHuman local server running (event and Socket.IO flaws)
What to do
Update OpenHuman to 0.56.0 or later. Versions before 0.56.0 are affected.
Products and platforms
CVE IDs
Sources
- Write-up: github.com (opens in a new tab)
Times
First published
First seen