OpenHands versions prior to 1.5.0 are vulnerable to OS command injection, enabling authenticated attackers to execute arbitrary commands within the agent sandbox.

This is an OS command injection flaw (CWE-78) occurring in the get_git_diff() method of the git_handler.py utility. The vulnerability is triggered by passing unsanitized input from the path parameter of the /api/conversations/{conversation_id}/git/diff endpoint to a shell command, which can be exploited by an authenticated user.

Successful exploitation allows an attacker to execute arbitrary commands in the agent sandbox environment, potentially leading to unauthorized data access or disruption of development workflows. Given the CVSS score of 7.6, this vulnerability poses a significant risk to the integrity and confidentiality of the AI-driven development environment, as it facilitates a bypass of intended security controls.

Immediate Action: Upgrade the OpenHands software to version 1.5.0 or later to ensure the path parameter is properly sanitized.

Proactive Monitoring: Review API access logs for anomalous requests to the /api/conversations/*/git/diff endpoint, specifically looking for shell-related metacharacters in the path parameter.

Compensating Controls: Implement strict network segmentation for the agent sandbox and utilize a Web Application Firewall (WAF) to inspect and block requests containing suspicious command injection patterns.

Public Exploit Available: Yes, a public proof-of-concept exists as identified in the GitHub repository HORKimhab/CVE-2026-33718.

The presence of a public proof-of-concept significantly elevates the urgency of this remediation. Security teams should prioritize the update to version 1.5.0 immediately to eliminate the injection vector. Failure to patch allows authenticated users to potentially escalate their privileges within the sandbox, which could lead to further unauthorized actions within the development infrastructure.