OpenHuman is an open-source agent harness available as a desktop application and Rust library.
OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.57.13, OpenHuman places names, descriptions, titles, and parameter definitions returned by configured external MCP servers into the agent model context without neutralizing instructions or bounding the descriptive fields. The McpRemoteTool records produced by list_tools preserve this remote content, while tool filtering considers the tool name and the prompt-injection detector screens user messages rather than MCP definitions. A malicious or compromised MCP server can therefore return a poisoned description that is evaluated on every agent turn and may direct the model to invoke other avai
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Tinyhumansai
- Product
- openhuman
- CVSS v3.1
- 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
- Fix
- available
- Exposure class
- AI infrastructure
- NVD status
- Received
Why it ranks 35 (Notable)
- CVSS v3.1 8.3 high
- Product class: AI infrastructure
- Fix available
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-54140 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.