{"id":"CVE-2026-19022","summary":"OpenHands send_pull_request.py initialize_repo command injection","details":"A vulnerability was determined in OpenHands up to 0.62.0. The affected element is the function initialize_repo of the file OpenHands/resolver/send_pull_request.py. This manipulation causes command injection. Remote exploitation of the attack is possible. The vendor deleted the original GitHub issue report. It appears that the affected path/file got removed in version 1.7.0.","modified":"2026-08-08T03:48:18.948172934Z","published":"2026-08-06T08:15:08.598Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"introduced":"0.1"},{"last_affected":"0.1"},{"introduced":"0.2"},{"last_affected":"0.2"}],"source":"AFFECTED_FIELD"}],"cna_assigner":"VulDB","cwe_ids":["CWE-74","CWE-77"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19022.json"},"references":[{"type":"WEB","url":"https://github.com/OpenHands/OpenHands/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19022.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19022"},{"type":"ADVISORY","url":"https://vuldb.com/cve/CVE-2026-19022"},{"type":"ADVISORY","url":"https://vuldb.com/submit/863529"},{"type":"ADVISORY","url":"https://vuldb.com/vuln/386426"},{"type":"REPORT","url":"https://github.com/OpenHands/OpenHands/issues/14903"},{"type":"REPORT","url":"https://vuldb.com/vuln/386426/cti"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/openhands/openhands","events":[{"introduced":"4b4bc15fdbe0b4603f68eb0ed635355c476fa4ce"},{"last_affected":"7fbb48c40679afd674970966b96185657d92a487"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"0.3"},{"last_affected":"0.3"},{"introduced":"0.4"},{"last_affected":"0.4"},{"introduced":"0.5"},{"last_affected":"0.5"},{"introduced":"0.6"},{"last_affected":"0.6"},{"introduced":"0.7"},{"last_affected":"0.7"},{"introduced":"0.8"},{"last_affected":"0.8"},{"introduced":"0.9"},{"last_affected":"0.9"},{"introduced":"0.10"},{"last_affected":"0.10"},{"introduced":"0.11"},{"last_affected":"0.11"},{"introduced":"0.12"},{"last_affected":"0.12"},{"introduced":"0.13"},{"last_affected":"0.13"},{"introduced":"0.14"},{"last_affected":"0.14"},{"introduced":"0.15"},{"last_affected":"0.15"},{"introduced":"0.16"},{"last_affected":"0.16"},{"introduced":"0.17"},{"last_affected":"0.17"},{"introduced":"0.18"},{"last_affected":"0.18"},{"introduced":"0.19"},{"last_affected":"0.19"},{"introduced":"0.20"},{"last_affected":"0.20"},{"introduced":"0.21"},{"last_affected":"0.21"},{"introduced":"0.22"},{"last_affected":"0.22"},{"introduced":"0.23"},{"last_affected":"0.23"},{"introduced":"0.24"},{"last_affected":"0.24"},{"introduced":"0.25"},{"last_affected":"0.25"},{"introduced":"0.26"},{"last_affected":"0.26"},{"introduced":"0.27"},{"last_affected":"0.27"},{"introduced":"0.28"},{"last_affected":"0.28"},{"introduced":"0.29"},{"last_affected":"0.29"},{"introduced":"0.30"},{"last_affected":"0.30"},{"introduced":"0.31"},{"last_affected":"0.31"},{"introduced":"0.32"},{"last_affected":"0.32"},{"introduced":"0.33"},{"last_affected":"0.33"},{"introduced":"0.34"},{"last_affected":"0.34"},{"introduced":"0.35"},{"last_affected":"0.35"},{"introduced":"0.36"},{"last_affected":"0.36"},{"introduced":"0.37"},{"last_affected":"0.37"},{"introduced":"0.38"},{"last_affected":"0.38"},{"introduced":"0.39"},{"last_affected":"0.39"},{"introduced":"0.40"},{"last_affected":"0.40"},{"introduced":"0.41"},{"last_affected":"0.41"},{"introduced":"0.42"},{"last_affected":"0.42"},{"introduced":"0.43"},{"last_affected":"0.43"},{"introduced":"0.44"},{"last_affected":"0.44"},{"introduced":"0.45"},{"last_affected":"0.45"},{"introduced":"0.46"},{"last_affected":"0.46"},{"introduced":"0.47"},{"last_affected":"0.47"},{"introduced":"0.48"},{"last_affected":"0.48"},{"introduced":"0.49"},{"last_affected":"0.49"},{"introduced":"0.50"},{"last_affected":"0.50"},{"introduced":"0.51"},{"last_affected":"0.51"},{"introduced":"0.52"},{"last_affected":"0.52"},{"introduced":"0.53"},{"last_affected":"0.53"},{"introduced":"0.54"},{"last_affected":"0.54"},{"introduced":"0.55"},{"last_affected":"0.55"},{"introduced":"0.56"},{"last_affected":"0.56"},{"introduced":"0.57"},{"last_affected":"0.57"},{"introduced":"0.58"},{"last_affected":"0.58"},{"introduced":"0.59"},{"last_affected":"0.59"},{"introduced":"0.60"},{"last_affected":"0.60"},{"introduced":"0.61"},{"last_affected":"0.61"},{"introduced":"0.62.0"},{"last_affected":"0.62.0"}]}}],"versions":["0.10","0.11","0.12","0.13","0.14","0.15","0.16","0.17","0.18","0.19","0.20","0.21","0.22","0.23","0.24","0.25","0.26","0.27","0.28","0.29","0.3","0.30","0.31","0.32","0.33","0.34","0.35","0.36","0.37","0.38","0.39","0.4","0.40","0.41","0.42","0.43","0.44","0.45","0.46","0.47","0.48","0.49","0.5","0.50","0.51","0.52","0.53","0.54","0.55","0.56","0.57","0.58","0.59","0.6","0.60","0.61","0.62.0","0.7","0.8","0.9","0.22.0","0.19.0","0.18.0","0.17.0","0.16.1","0.15.3","0.15.2","0.15.1","0.15.0","0.14.3","0.14.2","0.14.1","0.14.0","0.13.1","0.13.0","0.12.3","0.12.2","0.12.1","0.12.0","0.11.0","0.10.0","0.9.8","0.9.7","0.9.6","0.9.5","0.9.4","0.9.3","0.9.2","0.9.1","0.9.0","0.8.4","0.8.3","0.8.2","0.8.1","0.8.0","0.7.1","0.7.0","0.6.2","0.6.1","0.6.0","0.5.3","0.5.2","0.5.1","0.5.0","0.4.1","0.4.0","0.3.1","0.3.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19022.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X"}]}