OpenHarness Slash Commands Markdown Injection

Executive Summary

The vulnerability CVE-2026-56696 in OpenHarness involves the /issue and /pr_comments slash commands lacking proper protection to prevent remote invocation.

Because of this, remote attackers who are admitted channel senders can inject attacker-controlled Markdown content into project context files named .openharness/issue.md and .openharness/pr_comments.md.

These files are later injected into runtime system prompts, which means the malicious content persistently influences the behavior of local agents running on the system.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows remote attackers to persistently inject malicious Markdown content into project context files that are used in runtime system prompts.

As a result, the local agent's behavior can be influenced or manipulated by the attacker-controlled content, potentially causing unexpected or harmful actions.

The impact is rated as medium severity with a CVSS score around 5.3, indicating a moderate risk.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves unauthorized remote injection of Markdown content into the .openharness/issue.md and .openharness/pr_comments.md files via the /issue and /pr_comments slash commands.

To detect exploitation attempts on your system, you can monitor changes to these specific files for unexpected or suspicious content.

Suggested commands to check for suspicious modifications include:

• Use file integrity monitoring tools or commands like `git diff` if your project is under version control to detect unexpected changes in `.openharness/issue.md` and `.openharness/pr_comments.md`.
• Use `grep` to search for suspicious Markdown or attacker-controlled content in these files, for example: `grep -iE "<script|alert|malicious_keyword" .openharness/issue.md .openharness/pr_comments.md`.
• Check system logs or application logs for remote invocations of the /issue or /pr_comments commands if logging is enabled.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to apply the patch that marks the /issue and /pr_comments slash commands as local-only by default, preventing remote invocation.

This patch sets the attribute `remote_invocable=False` for these commands, restricting their use to the local OpenHarness UI only.

Additionally, ensure that remote administration is only enabled explicitly and cautiously via the `remote_admin_opt_in=True` setting.

If patching immediately is not possible, restrict network access to trusted users and monitor the affected files for unauthorized changes.

Review and update your security policies to prevent untrusted remote users from sending commands that can modify project context files.

Useful 0 Not Useful 0

Compliance Impact

The provided context and resources do not include any information regarding the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0