GCVE - cpe:2.3:a:ifuryst:open-computer-use:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:ifuryst:open-computer-use:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Ifuryst (`553a6985-badf-5661-932e-ddb0cc4b10c7`)
Product	Open Computer Use (`1db22e6b-11bb-5e87-8516-9b4c54977c47`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-108721`	vulnerable	2026-11-03 10:18:02.156185	Open Computer Use through 1.0.0 Denylist Bypass via Case-Variant Bundle ID MEDIUM (5.3) Open Computer Use through 1.0.0 on macOS contains an improper case sensitivity handling vulnerability that allows local MCP callers to bypass the password-manager denylist using case-variant bundle identifiers. Attackers, including prompt-injected model turns, can pass identifiers like com.1Password.1Password to get_app_state and action tools to read accessibility trees, capture screenshots, and drive unlocked password manager interfaces. Published: 2026-10-11T12:19:31.981Z Updated: 2026-10-13T17:01:12.777Z Open on db.gcve.eu Reference links https://hackmd.io/@haind/rJHI_S6IiMl https://github.com/iFurySt/open-codex-computer-use/blob/8a3a7dec06402db2d760368cb24676ad3ba42c49/packages/OpenComputerUseKit/Sources/OpenComputerUseKit/AppDiscovery.swift#L144-L198 https://github.com/iFurySt/open-codex-computer-use/blob/8a3a7dec06402db2d760368cb24676ad3ba42c49/packages/OpenComputerUseKit/Sources/OpenComputerUseKit/AppDiscovery.swift#L554-L572 https://github.com/iFurySt/open-codex-computer-use https://www.vulncheck.com/advisories/open-computer-use-through-1.0.0-denylist-bypass-via-case-variant-bundle-id	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.