GHSA-g6j9-89xv-v752: OpenHuman: MCP tool description injection: untrusted server descriptions execute in agent LLM context without sanitization
OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.57.13, OpenHuman places names, descriptions, titles, and parameter definitions returned by configured external MCP servers into the agent model context without neutralizing instructions or bounding the descriptive fields. The McpRemoteTool records produced by listtools preserve this remote content, while tool filtering considers the tool name and the prompt-injection detector screens user messages rather than MCP definitions. A malicious or compromised MCP server can therefore return a poisoned description that is evaluated on every agent turn and may direct the model to invoke other available tools, disclose accessible data, or perform unauthorized actions without a separate malicious user message. The issue affects users who configure an attacker-controlled or compromised MCP server. This issue is fixed in version 0.57.13.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenHumanto a version that resolves this vulnerability.Fixed in 0.57.13
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users are affected if they configure an attacker-controlled or compromised external MCP server. The malicious content is returned by that server through its tool definitions and is placed into the agent's model context.
Does exploitation require a malicious user prompt or authenticated access?
No separate malicious user message is required, because the poisoned MCP tool description can be evaluated on every agent turn. The reported vector has no privileges requirement, but exploitation requires the user to have configured the malicious or compromised MCP server.
What can a malicious MCP server cause the agent to do?
A poisoned tool description may direct the model to invoke other available tools, disclose data accessible to the agent, or perform unauthorized actions. The impact depends on the tools and data available in that agent environment.
What should teams do if they cannot immediately update?
Remove or disable untrusted MCP servers and review configured servers for compromise. Restrict the agent's access to sensitive data and high-impact tools where possible, since remote tool descriptions are included in the model context.
What version contains the fix?
The issue is fixed in OpenHuman version 0.57.13. Versions before 0.57.13 are affected when an attacker-controlled or compromised MCP server is configured.