Description
OpenHarness /issue and /pr_comments slash commands lack remote_invocable=False protection, allowing remote channel senders to write attacker-controlled Markdown into project context files. Admitted remote attackers can inject malicious content into .openharness/issue.md and .openharness/pr_comments.md files, which are subsequently injected into runtime system prompts, persistently influencing local agent behavior.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
HKUDS OpenHarness
Default version status: unaffected
0 to ≤ 0.1.9affected27bb93b810e9ea8fa4832eab7152eeb3b4a6bffbunaffected
pkg:pypi/openharness-ai