HKUDS OpenHarness contains an OS command injection vulnerability (CWE-78) in the /bridge slash command interface. Remote attackers accepted by configuration can invoke the /bridge spawn command with attacker-controlled command text. This text is executed by the bridge session manager through a shared shell subprocess helper, allowing arbitrary command execution with the privileges of the OpenHarness process user. This vulnerability enables attackers to spawn shell sessions, potentially accessing sensitive local data and repository contents. The CVSS 4.0 score is 8.7 (high severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation level has been published, and the product is not a cloud service.

Successful exploitation allows remote attackers to execute arbitrary operating system commands with the privileges of the OpenHarness process user. This can lead to unauthorized access to local files, credentials, workspace state, and repository contents, potentially compromising confidentiality, integrity, and availability of the affected system. The vulnerability is exploitable remotely without user interaction and requires no prior privileges beyond being accepted by configuration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /bridge slash command to trusted users only and monitor for any unusual activity related to command execution. Avoid exposing the OpenHarness interface to untrusted networks. Follow vendor communications for updates on patches or official mitigations.