CVE-2026-19022

MEDIUM 6.3

OpenHands send_pull_request.py initialize_repo command injection

CVSS Score

6.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was determined in OpenHands up to 0.62.0. The affected element is the function initialize_repo of the file OpenHands/resolver/send_pull_request.py. This manipulation causes command injection. Remote exploitation of the attack is possible. The vendor deleted the original GitHub issue report. It appears that the affected path/file got removed in version 1.7.0.

CWE	CWE-77 CWE-74
Vendor	n/a
Product	openhands
Published	Aug 6, 2026

Stay Ahead of the Next One

Get instant alerts for n/a openhands

Be the first to know when new medium vulnerabilities affecting n/a openhands are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

n/a / OpenHands

0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 0.10 0.11 0.12 0.13 0.14 0.15 0.16 0.17 0.18 0.19 0.20 0.21 0.22 0.23 0.24 0.25 0.26 0.27 0.28 0.29 0.30 0.31 0.32 0.33 0.34 0.35 0.36 0.37 0.38 0.39 0.40 0.41 0.42 0.43 0.44 0.45 0.46 0.47 0.48 0.49 0.50 0.51 0.52 0.53 0.54 0.55 0.56 0.57 0.58 0.59 0.60 0.61 0.62.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/386426 vuldb.com: https://vuldb.com/vuln/386426/cti vuldb.com: https://vuldb.com/cve/CVE-2026-19022 vuldb.com: https://vuldb.com/submit/863529 github.com: https://github.com/OpenHands/OpenHands/issues/14903 github.com: https://github.com/OpenHands/OpenHands/

Credits

🔍 edoardottt (VulDB User) VulDB CNA Team