CVE-2026-56696: OpenHarness Remote Slash Command Injection via Missing Invocation Controls

Technical summary

The vulnerability stems from missing remote_invocable=False protection on OpenHarness slash command implementations. The /issue and /pr_comments endpoints accept input from any authenticated channel participant without validating the command origin or enforcing invocation restrictions. Attacker-supplied Markdown is written directly into project context files that are later parsed and injected into runtime system prompts for local AI agents. Because these files persist in the repository, the injection remains active across multiple agent invocations until manually remediated. The attack chain requires authenticated channel access but no elevated privileges, making it accessible to any workspace member.

Business impact

This vulnerability creates an insidious persistent attack surface for organizations using OpenHarness with AI-assisted development workflows. An insider threat or compromised account can silently alter how AI agents interpret tasks and respond to requests, potentially leading to code generation flaws, security bypass recommendations, or compliance violations. The stealthy nature—injected instructions live in configuration files rather than in-band communications—means the manipulation may go undetected across multiple development cycles. Teams relying on agent outputs for critical decisions face both direct code quality risk and potential liability if malicious suggestions influence production deployments.

Affected systems

OpenHarness installations with active /issue and /pr_comments slash commands are affected. The vulnerability applies to all versions lacking the remote_invocable=False protection on these endpoints. Any workspace or organization channel where OpenHarness bots are configured to respond to these commands is at risk. The impact scales with the number of developers interacting with poisoned context files and the criticality of systems influenced by agent recommendations.

Exploitability

Exploitation requires authenticated access to a channel where OpenHarness commands are active—a low barrier for insider threats or compromised user accounts. No special tools, complexity, or user interaction are needed beyond issuing standard slash commands. The attacker's crafted Markdown is immediately written to project files without validation. The CVSS 3.1 score of 5.4 (MEDIUM) reflects the requirement for prior authentication, but the persistent nature and potential for widespread behavioral manipulation elevate practical risk above the base score suggests.

Remediation

Organizations should immediately patch OpenHarness to a version that implements remote_invocable=False protection on the /issue and /pr_comments slash command handlers. This restricts these commands to local, trusted invocations only. As an interim control, limit slash command access via workspace IAM policies and audit who can trigger these commands. Review existing .openharness/issue.md and .openharness/pr_comments.md files across all projects for suspicious Markdown or unusual agent prompt injections. Remove or revert any compromised configuration files.

Patch guidance

Verify against the vendor advisory for the specific version that resolves this issue. Once patched, verify that /issue and /pr_comments command handlers have been updated to enforce remote_invocable=False. Test in a non-production environment to confirm that slash commands no longer accept remote invocations before rolling out to production. Audit existing configuration files as part of the deployment to detect and clean any prior injections.

Detection guidance

Monitor for unusual slash command usage, particularly /issue and /pr_comments invocations followed by file modifications to .openharness/issue.md or .openharness/pr_comments.md. Review git history for unexpected changes to these configuration files, especially modifications that include Markdown or instructions that don't correspond to legitimate project issues or pull requests. Inspect system prompt logs if available to identify evidence of injected content influencing agent behavior. Alert on any Markdown containing suspicious directives, prompt-injection patterns, or content from unexpected sources.

Why prioritize this

While the CVSS score is MEDIUM, the vulnerability warrants elevated priority due to its persistent nature and the subtle risks posed to AI-driven development workflows. The injection affects multiple downstream processes and may remain undetected for prolonged periods. Organizations with high reliance on AI agents for code generation, security recommendations, or compliance tasks should treat this as HIGH priority. Those with strict access controls limiting slash command usage to specific roles or users may lower priority accordingly, but should still remediate.

Risk score, explained

CVSS 3.1 score of 5.4 reflects low attack complexity, network accessibility, and requirement for low-privilege authentication (CWE-862: Improper Authorization). The MEDIUM severity excludes confidentiality or integrity of protected systems but acknowledges the injection of attacker-controlled content into system prompts. The persistent nature of the attack—files remain poisoned across sessions—elevates practical risk beyond the base score, warranting business-level context in prioritization decisions.

Frequently asked questions