CVE-2026-19022 — OpenHands send_pull_request.py initialize_repo command injection

Description (CNA)

A vulnerability was determined in OpenHands up to 0.62.0. The affected element is the function initialize_repo of the file OpenHands/resolver/send_pull_request.py. This manipulation causes command injection. Remote exploitation of the attack is possible. The vendor deleted the original GitHub issue report. It appears that the affected path/file got removed in version 1.7.0.

Affected (CNA)

Vendor / product	Versions
n/a / OpenHands	affected 0.1; affected 0.2; affected 0.3; affected 0.4; affected 0.5; affected 0.6; affected 0.7; affected 0.8; affected 0.9; affected 0.10; affected 0.11; affected 0.12; affected 0.13; affected 0.14; affected 0.15; affected 0.16; affected 0.17; affected 0.18; affected 0.19; affected 0.20; affected 0.21; affected 0.22; affected 0.23; affected 0.24; affected 0.25; affected 0.26; affected 0.27; affected 0.28; affected 0.29; affected 0.30; affected 0.31; affected 0.32; affected 0.33; affected 0.34; affected 0.35; affected 0.36; affected 0.37; affected 0.38; affected 0.39; affected 0.40; affected 0.41; affected 0.42; affected 0.43; affected 0.44; affected 0.45; affected 0.46; affected 0.47; affected 0.48; affected 0.49; affected 0.50; affected 0.51; affected 0.52; affected 0.53; affected 0.54; affected 0.55; affected 0.56; affected 0.57; affected 0.58; affected 0.59; affected 0.60; affected 0.61; affected 0.62.0

Vendor / product

Versions

n/a / OpenHands

affected 0.1; affected 0.2; affected 0.3; affected 0.4; affected 0.5; affected 0.6; affected 0.7; affected 0.8; affected 0.9; affected 0.10; affected 0.11; affected 0.12; affected 0.13; affected 0.14; affected 0.15; affected 0.16; affected 0.17; affected 0.18; affected 0.19; affected 0.20; affected 0.21; affected 0.22; affected 0.23; affected 0.24; affected 0.25; affected 0.26; affected 0.27; affected 0.28; affected 0.29; affected 0.30; affected 0.31; affected 0.32; affected 0.33; affected 0.34; affected 0.35; affected 0.36; affected 0.37; affected 0.38; affected 0.39; affected 0.40; affected 0.41; affected 0.42; affected 0.43; affected 0.44; affected 0.45; affected 0.46; affected 0.47; affected 0.48; affected 0.49; affected 0.50; affected 0.51; affected 0.52; affected 0.53; affected 0.54; affected 0.55; affected 0.56; affected 0.57; affected 0.58; affected 0.59; affected 0.60; affected 0.61; affected 0.62.0

CWE

CWE-77, CWE-74

References

ADP enrichment

CISA-ADP

No English description supplied.

https://vuldb.com/submit/863529