Evidence record / openhands
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.
2026-10-13-openhands-anyio-tls-certificate-spoofing-remediation-reaches-the-canvas-v1-25-0-backends
AnyIO TLS certificate-spoofing remediation reaches the Canvas v1.25.0 backends. The SDK workspace constraint and lock, and automation lock, move AnyIO to 4.14.2. CVE-2026-63374 / GHSA-82r6-8w77-94w6 concerns certificate spoofing for certain redirected TLS connections to internationalized hostnames: IDNA 2003 encoding can make the wrong encoded name validate. The advisory predates this window; OpenHands remediation is in-window. This is not a generic unauthenticated code-execution bug. Both newest backend locks still select 4.14.2.
Channel: tagged-release. Half: defect. Date: 2026-09-29 (SDK v1.50.0 and automation 1.15.2); 2026-10-06 (Canvas v1.25.0 bundle).
Operator consequence: Use the corrected released/locked builds and inspect AnyIO in the actual installed environment. A repository lock or workspace constraint does not prove what every uvx/PyPI resolver installed. No reachable OpenHands exploit or live installed environment was established here.
Receipt
- https://github.com/OpenHands/software-agent-sdk/commit/7fa122478a3d90710cc2525c51c02aec0867b252
- https://github.com/OpenHands/automation/commit/53f3209f4e4565c1d4cc6ca27b9f28a603ad905c
- https://github.com/OpenHands/software-agent-sdk/releases/tag/v1.50.0
- https://github.com/OpenHands/automation/releases/tag/1.15.2
- https://github.com/advisories/GHSA-82r6-8w77-94w6
- https://github.com/OpenHands/software-agent-sdk/blob/v1.54.0/uv.lock
- https://github.com/OpenHands/automation/blob/1.19.3/uv.lock
Finding metadata
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
Finding ID: 2026-10-13-openhands-anyio-tls-certificate-spoofing-remediation-reaches-the-canvas-v1-25-0-backends
Profile citations
- OpenHands / claim / anyio-remediation
Source links
Primary links, including exact changelog lines when available.
- commit2026-10-13-openhands-anyio-tls-certificate-spoofing-remediation-reaches-the-canvas-v1-25-0-backendsgithub.com/OpenHands/software-agent-sdk/commit/7fa122478a3d90710cc2525c51c02aec0867b252commit2026-10-13-openhands-anyio-tls-certificate-spoofing-remediation-reaches-the-canvas-v1-25-0-backendsgithub.com/OpenHands/automation/commit/53f3209f4e4565c1d4cc6ca27b9f28a603ad905cgithub release2026-10-13-openhands-anyio-tls-certificate-spoofing-remediation-reaches-the-canvas-v1-25-0-backendsOpenHands/software-agent-sdk / v1.50.0github release2026-10-13-openhands-anyio-tls-certificate-spoofing-remediation-reaches-the-canvas-v1-25-0-backendsOpenHands/automation / 1.15.2official docs2026-10-13-openhands-anyio-tls-certificate-spoofing-remediation-reaches-the-canvas-v1-25-0-backendsgithub.com/advisories/GHSA-82r6-8w77-94w6tagged commit file2026-10-13-openhands-anyio-tls-certificate-spoofing-remediation-reaches-the-canvas-v1-25-0-backendsOpenHands/software-agent-sdk / uv.locktagged commit file2026-10-13-openhands-anyio-tls-certificate-spoofing-remediation-reaches-the-canvas-v1-25-0-backendsOpenHands/automation / uv.lock
Versioned source: run artifact