OpenShell versions before 2026.3.28 contain an arbitrary code execution vulnerability in mirror mode functionality. The vulnerability allows attackers with mirror mode access to convert untrusted sandbox files into workspace hooks. This enables execution of arbitrary code on the host system during gateway startup. The vulnerability is exploited through enabled workspace hooks and affects the file conversion process in mirror mode. Successful exploitation requires mirror mode access but can lead to complete system compromise.