The vulnerability in HKUDS OpenHarness involves missing authorization controls on the /issue and /pr_comments slash commands, which do not have remote_invocable=False protection. This allows remote channel senders to write arbitrary Markdown content into .openharness/issue.md and .openharness/pr_comments.md files. Since these files are injected into runtime system prompts, the injected content can persistently affect the behavior of the local agent. The affected versions are all versions up to and including 0.1.9. There is no official remediation or patch available as of the published date.

An attacker with remote access to the affected slash commands can inject malicious Markdown content into project context files that are later used in runtime system prompts. This persistent injection can influence the behavior of the local agent, potentially leading to unauthorized actions or manipulation of system operations. The vulnerability has a CVSS 4.0 base score of 5.3, indicating a medium severity impact with network attack vector, low complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected slash commands to trusted users only and monitor for suspicious activity related to the injection of Markdown content into the .openharness directory. Avoid exposing these commands to untrusted remote channels.