Open Computer Use through 1.0.0 Denylist Bypass via Case-Variant Bundle ID

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-108721 · Microsoft / collected KEV context

cve-program · CVE-2026-108721

• https://hackmd.io/@haind/rJHI_S6IiMl
• https://github.com/iFurySt/open-codex-computer-use/blob/8a3a7dec06402db2d760368cb24676ad3ba42c49/packages/OpenComputerUseKit/Sources/OpenComputerUseKit/AppDiscovery.swift#L144-L198
• https://github.com/iFurySt/open-codex-computer-use/blob/8a3a7dec06402db2d760368cb24676ad3ba42c49/packages/OpenComputerUseKit/Sources/OpenComputerUseKit/AppDiscovery.swift#L554-L572
• https://github.com/iFurySt/open-codex-computer-use
• https://www.vulncheck.com/advisories/open-computer-use-through-1.0.0-denylist-bypass-via-case-variant-bundle-id

No related operational record is retained in the current change model.