CVE-2026-33718 is a command injection flaw in OpenHands, software for AI driven development. NVD scores it 7.6. An authenticated user can run commands in the agent sandbox through the git diff API by passing a crafted path. Upgrade to OpenHands 1.5.0.
What's affected
The NVD record says the issue starts in version 1.5.0 and the text says version 1.5.0 fixes it, which is contradictory. The GitHub advisory is clearer: affected versions are 1.4.0 and below, and the patched version is 1.5.0. Follow the advisory and move to 1.5.0 or later.
The flaw is in get_git_diff() in openhands/runtime/utils/git_handler.py. The path parameter of the conversation git diff endpoint is passed unsanitized into a shell command.
How to check if you're exposed
pip list | grep -i openhands
If you run OpenHands from a container image, check the tag you deploy. Then consider who can reach the API. The advisory says the attacker must be authenticated, and notes that such users can already ask the agent to run commands. The bug bypasses the normal channels that govern that.
What to do now
- Upgrade OpenHands to 1.5.0 or later.
- Limit API access to people you already trust with command execution in the sandbox.
- Review the sandbox for unexpected files or processes, and check that it has no more network or credential access than it needs.
- Do not mount host secrets into the agent sandbox.
Why it matters
The record uses CWE-78, OS command injection. User input is placed into a shell command string, so shell syntax in the input becomes part of the command. The references in the record point to Python's shlex.quote and subprocess security guidance, which describe the standard fix: quote the input or avoid the shell and pass arguments as a list.
The impact is bounded by the sandbox, which is the point of having one. The record is not marked as exploited in the wild and is not in CISA KEV.
Agent platforms blur the line between a user who may run commands and one who may not. When an API takes a path or filename from a client, pass it to subprocesses as a separate argument, never as part of a shell string, and validate it against the repository root. Review other endpoints in tools like this for the same pattern.
Quick check
Which version should I run?
OpenHands 1.5.0 or later, per the GitHub advisory.
Sources
Last reviewed: 19 October 2026.
