Summary
OpenHuman can process direct messages from a configured Yuanbao channel without creating the interactive approval context expected by its tool policy. Under the stated conditions, an external sender may influence the agent to run JavaScript and operating-system commands as the OpenHuman user without an approval prompt.
OpenHuman can process direct messages from a configured Yuanbao channel without creating the interactive approval context expected by its tool policy. Under the stated conditions, an external sender may influence the agent to run JavaScript and operating-system commands as the OpenHuman user without an approval prompt.
Affected context
The issue affects OpenHuman deployments before the fix that use a configured Yuanbao channel to receive direct messages. Risk arises when the default approval-requiring policy is active, Node is available, and the agent selects node_exec: the channel request lacks the interactive approval context, and the approval gate allows execution in that state.
The issue affects OpenHuman deployments before the fix that use a configured Yuanbao channel to receive direct messages. Risk arises when the default approval-requiring policy is active, Node is available, and the agent selects node_exec: the channel request lacks the interactive approval context, and the approval gate allows execution in that state.
Exploit preconditions
- Attack surface: Direct messages received through a configured Yuanbao channel
- Required access: The sender must be able to message the connected bot; Yuanbao direct messages are open by default
- Required configuration: The approval-requiring default Supervised policy is active and Node is enabled
- Trigger point: The agent processes a message and selects
node_exec - Why exploitation is possible: The channel request does not establish an interactive approval context, and the approval gate allows execution when that context is missing
- Attack surface: Direct messages received through a configured Yuanbao channel
- Required access: The sender must be able to message the connected bot; Yuanbao direct messages are open by default
- Required configuration: The approval-requiring default Supervised policy is active and Node is enabled
- Trigger point: The agent processes a message and selects
node_exec - Why exploitation is possible: The channel request does not establish an interactive approval context, and the approval gate allows execution when that context is missing
Why this happens
The channel converts a remote direct message into a generic agent turn without carrying the approval context required for interactive authorization. The approval gate treats the missing context as a non-interactive turn and permits a write operation that should require approval. This is primarily a CWE-862: Missing Authorization issue; the ability to run JavaScript and operating-system commands through the selected tool can result in code execution, corresponding to CWE-94: Improper Control of Generation of Code.
The channel converts a remote direct message into a generic agent turn without carrying the approval context required for interactive authorization. The approval gate treats the missing context as a non-interactive turn and permits a write operation that should require approval. This is primarily a CWE-862: Missing Authorization issue; the ability to run JavaScript and operating-system commands through the selected tool can result in code execution, corresponding to CWE-94: Improper Control of Generation of Code.
Potential impact
- An external sender may cause commands to run with the permissions of the OpenHuman user
- An attacker could access or alter data available to the agent
- Execution could lead to changes in the local environment or connected resources
- A compromised agent could be used to pursue further actions within its granted privileges
- An external sender may cause commands to run with the permissions of the OpenHuman user
- An attacker could access or alter data available to the agent
- Execution could lead to changes in the local environment or connected resources
- A compromised agent could be used to pursue further actions within its granted privileges
General mitigation guidance
Defensive patterns focus on making tool authorization explicit and ensuring that missing context never weakens approval requirements.
- Require an explicit, validated approval context before executing approval-gated operations
- Fail closed when authorization context is absent or cannot be verified
- Apply the same tool authorization policy to messages from every channel
- Restrict direct-message access and treat incoming messages as untrusted input
- Disable Node or limit tool permissions when those capabilities are not necessary
- Run the agent with least privilege to reduce the consequences of unintended command execution
Defensive patterns focus on making tool authorization explicit and ensuring that missing context never weakens approval requirements.
- Require an explicit, validated approval context before executing approval-gated operations
- Fail closed when authorization context is absent or cannot be verified
- Apply the same tool authorization policy to messages from every channel
- Restrict direct-message access and treat incoming messages as untrusted input
- Disable Node or limit tool permissions when those capabilities are not necessary
- Run the agent with least privilege to reduce the consequences of unintended command execution
How teams detect issues like this
- Use static analysis and code review to find approval checks that allow operations when authorization context is absent
- Trace how channel-specific requests populate approval metadata and verify that tool policies apply consistently across channels
- Test that approval-gated tools are denied when context is missing, malformed, or non-interactive
- Monitor agent and tool-execution logs for commands initiated from external channel messages without corresponding approval records
- Enforce policies requiring explicit authorization checks before sensitive tool execution; automated code review can help identify suspicious control-flow patterns
- Use static analysis and code review to find approval checks that allow operations when authorization context is absent
- Trace how channel-specific requests populate approval metadata and verify that tool policies apply consistently across channels
- Test that approval-gated tools are denied when context is missing, malformed, or non-interactive
- Monitor agent and tool-execution logs for commands initiated from external channel messages without corresponding approval records
- Enforce policies requiring explicit authorization checks before sensitive tool execution; automated code review can help identify suspicious control-flow patterns
