A AegiFlow
MEDIUMCVSS 5.3EPSS 0.4%

CVE-2026-56696

OpenHarness remote project-context commands allow persistent prompt poisoning

Published
2026-06-23
Modified
2026-09-04
EPSS percentile
30%
Aliases
GHSA-24cw-228q-3rx9
Sources
github-advisory

Summary

OpenHarness /issue and /pr_comments slash commands lack remote_invocable=False protection, allowing remote channel senders to write attacker-controlled Markdown into project context files. Admitted remote attackers can inject malicious content into .openharness/issue.md and .openharness/pr_comments.md files, which are subsequently injected into runtime system prompts, persistently influencing local agent behavior.

Affected packages

EcosystemPackageAffected versionsFixed versions
PyPIopenharness-ai

Remediation: No patched version is listed by GitHub.

References

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.