Skip to content
OpenAdvisories

Package · PyPI

openharness-ai

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 5.4
    CVE-2026-56696

    OpenHarness - Prompt Injection via /issue and /pr_comments Slash Commands

    OpenHarness /issue and /pr_comments slash commands lack remote_invocable=False protection, allowing remote channel senders to write attacker-controlled Markdown into project context files. Admitted remote attackers can inject malicious content into .openharne…

    HKUDS OpenHarness openharness-ai PyPI
  • Medium 6.5
    CVE-2026-56695

    OpenHarness - Cross-Session Disclosure via /resume and /summary Commands

    OpenHarness ohmo gateway /resume and /summary slash commands default remote_invocable to True, allowing admitted remote senders to enumerate and load arbitrary session snapshots by ID. Attackers can exploit this to access victim snapshots containing private p…

    HKUDS OpenHarness openharness-ai PyPI