CVE-2026-7551 is an OS command injection vulnerability in HKUDS OpenHarness (version 0) affecting the /bridge slash command. Remote attackers authorized by configuration can execute arbitrary operating system commands by supplying crafted command text to the /bridge spawn command. This input is forwarded to the bridge session manager and executed via a shared shell subprocess helper, allowing attackers to spawn shell sessions with the privileges of the OpenHarness process user. This can lead to unauthorized access to local files, credentials, workspace state, and repository contents. The vulnerability has a CVSS 4.0 score of 8.7, indicating high severity. No official patch or remediation level has been published, and no known exploits are reported in the wild.

Successful exploitation results in remote code execution with the privileges of the OpenHarness process user. Attackers can spawn shell sessions, potentially accessing sensitive local files, credentials, workspace state, and repository data. This can lead to significant compromise of the affected system and its data integrity and confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /bridge slash command to trusted users only and monitor configuration to limit remote senders accepted by the system. Avoid exposing the OpenHarness service to untrusted networks. Follow vendor updates for any forthcoming patches or mitigations.