The vulnerability in HKUDS OpenHarness (<=0.1.9) involves missing authorization controls on the /issue and /pr_comments slash commands. These commands do not have remote_invocable=False protection, enabling remote channel senders to write arbitrary Markdown into .openharness/issue.md and .openharness/pr_comments.md files. Since these files are injected into runtime system prompts, attackers can persistently influence the behavior of local agents by injecting malicious content.

Remote attackers with the ability to send commands to the affected OpenHarness instance can inject malicious Markdown content into project context files. This content is persistently included in runtime prompts, potentially altering the behavior of local agents. The vulnerability does not require user interaction and has low attack complexity but requires some privileges (PR:L). There is no indication of privilege escalation or direct system compromise from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected slash commands and monitor usage to prevent unauthorized remote invocations. Avoid exposing OpenHarness instances to untrusted remote channels.