Published: August 6, 2026 | Last Modified: August 6, 2026
A vulnerability was determined in OpenHands up to 0.62.0. The affected element is the function initialize_repo of the file OpenHands/resolver/send_pull_request.py. This manipulation causes command injection. Remote exploitation of the attack is possible. The vendor deleted the original GitHub issue report. It appears that the affected path/file got removed in version 1.7.0.
Exploitation Probability (EPSS): Moderate — 1.29% (68th percentile)
Measurable exploitation probability. Should be patched in the normal vulnerability management cycle.
This analysis is generated by Ghostwire from NVD, CISA KEV, EPSS, and open-source intelligence data. Verify findings through primary sources before acting.