OpenHuman Shell Tool Allowlist Bypass via Env-Prefix / find -execdir (CVE-2026-55743)
OpenHuman's desktop AI agent restricts which shell commands it will run, but a flaw lets attackers slip past that restriction and run arbitrary code anyway. It affects versions up to 0.54.0 running the default 'Supervised' security policy.
How the attack works
The agent's allowlist checker strips off any leading KEY=value environment variable assignment before deciding whether a command is safe, so it never actually inspects that assignment. An attacker exploits this by prefixing an approved command (like git) with a dangerous environment variable such as GIT_PAGER, GIT_SSH_COMMAND, LD_PRELOAD, or BASH_ENV that points to a malicious script, e.g. 'GIT_PAGER=/tmp/payload.sh git log'. When git runs, it invokes the attacker's script through that variable, even though git itself was the only thing on the allowlist. A second, related gap: the allowlist blocks find's -exec and -ok flags but forgets their equally dangerous twins -execdir and -okdir, which also let find launch arbitrary commands.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 257d3128-f65c-424b-92bc-f8741ac5b366
- Severity
- Critical
- CVEs
- CVE-2026-55743
Why it matters
An attacker who can get the agent to run an allowlisted command can instead execute arbitrary code on the host, fully defeating the command restriction that the security policy was supposed to enforce.
What you can do
- →Upgrade OpenHuman past the version where is_command_allowed() and is_args_safe() were patched to validate env-var prefixes and reject -execdir/-okdir.
- →Until patched, review or restrict agent policies so inline environment-variable assignments are not permitted before allowlisted binaries.
- →Block or monitor use of find with -exec, -ok, -execdir, and -okdir flags in agent-invoked shell commands.
- →Audit agent logs for commands prefixed with GIT_EXTERNAL_DIFF, GIT_SSH_COMMAND, GIT_PAGER, LD_PRELOAD, BASH_ENV, or PYTHONSTARTUP pointing at unexpected paths.
Known benign look-alikes
- Benign inline env vars that do not spawn subprocesses (e.g. TZ=UTC git log, LANG=C ls, NODE_ENV=production npm test).
- Legitimate use of find with -exec/-ok flags that are already covered by the allowlist, without -execdir/-okdir.
- Documentation or advisory text that mentions GIT_PAGER or LD_PRELOAD without an assignment to an executable path preceding an allowlisted command.