CVE-2025-2733

mannaandpoem OpenManus Prompt python_execute.py os command injection

State: Published
Severity: 5.3 Medium
Published: Mar 25, 2025
Updated: Mar 25, 2025
Reserved: Mar 24, 2025

Description

A vulnerability classified as critical has been found in mannaandpoem OpenManus up to 2025.3.13. This affects an unknown part of the file app/tool/python_execute.py of the component Prompt Handler. The manipulation leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N	VulDB
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	VulDB
3.0	6.3 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	VulDB
2.0	6.5 Medium	AV:N/AC:L/Au:S/C:P/I:P/A:P	VulDB

Weaknesses

CWE-78 OS Command Injection
CWE-77 Command Injection

Affected Products

Product	Versions
OpenManusmannaandpoem	2025.3.0Affected 2025.3.1Affected 2025.3.2Affected 2025.3.3Affected 2025.3.4Affected 2025.3.5Affected 2025.3.6Affected 2025.3.7Affected 2025.3.8Affected 2025.3.9Affected 2025.3.10Affected 2025.3.11Affected 2025.3.12Affected 2025.3.13Affected

References

VDB-300753 | mannaandpoem OpenManus Prompt python_execute.py os command injectionvdb-entry
VDB-300753 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #520426 | OpenManus 2025.3.13 OS Command Injectionthird-party-advisory
https://magnificent-dill-351.notion.site/Command-Execution-in-Openmanus-2025-3-13-1b6c693918ed80b2826ef6bb385693faexploit

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.