CVE-2026-54144Medium· 6.1▾ SunlitOpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.56.0 on macOS, the runtime injected into a supported remote account webview such as Google Meet allows page JavaScript to call getDis…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 33.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.56.0 on macOS, the runtime injected into a supported remote account webview such as Google Meet allows page JavaScript to call getDisplayMedia without a live user gesture. Instead of rejecting the request, the shim falls through to native Chromium capture behavior, and the embedded CEF environment can auto-select the primary display because it lacks the normal desktop-media picker. If OpenHuman already has macOS Screen Recording permission and an attacker obtains JavaScript execution in an allowed embedded origin, the attacker can obtain a real desktop capture stream without a new user gesture. The stream can expose chats, documents, source code, email, meeting content, credentials, one-time codes, and other visible desktop information. The separate direct screen_share_begin_session IPC path failing origin validation does not prevent exploitation through getDisplayMedia. This issue is fixed in version 0.56.0.
openhuman < 0.56.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-49405Medium· 6.2OpenHuman: Unauthenticated server-sent events endpoint leaks user-facing event data
CVE-2026-54143Critical· 9.8OpenHuman allows remote inbound channel messages to create unapproved shell cron jobs leading to host command execution
CVE-2026-49393High· 8.4OpenHuman: Unauthenticated Socket.IO RPC bypass allows invoking protected OpenHuman core controllers without the Bearer token
CVE-2026-49410High· 8.1OpenHuman /auth/telegram CSRF allows attacker-controlled session implantation
CVE-2026-54142High· 8.7OpenHuman: Indirect prompt injection via background email sync executes Composio actions without user approval
CVE-2026-49407High· 7.7OpenHuman: Unauthenticated dictation WebSocket allows arbitrary audio streaming and unbounded memory growth