OpenHuman Shell Tool Allowlist Bypass via Env-Prefix / find -execdir (CVE-2026-55743) - ATR-2026-01959 (d649057f-9f75-5b37-b342-8928a34e6371)
Detects CVE-2026-55743 (CRITICAL): the shell tool command allowlist in OpenHuman desktop agent <= 0.54.0 (default Supervised SecurityPolicy) is bypassed because is_command_allowed() strips leading inline KEY=value environment-variable assignments (skip_env_assignments) before validation, and is_args_safe() blocks find -exec/-ok but not the functionally identical -execdir/-okdir. An attacker prefixes an allowlisted command with a dangerous env var (GIT_EXTERNAL_DIFF, GIT_SSH_COMMAND, GIT_PAGER, LD_PRELOAD, BASH_ENV, PYTHONSTARTUP) pointing at a payload, e.g. "GIT_PAGER=/tmp/payload.sh git log", so the allowlisted git binary executes the attacker-controlled subprocess. This rule keys on a dangerous env-var assignment (= path/command) immediately preceding an allowlisted binary, and on find with -execdir/-okdir.