Executive brief
OpenHarness, an AI development and testing framework, contains a security flaw in how it handles remote chat commands. An attacker with basic chat access can bypass security restrictions to execute administrative commands, such as changing the system's permission modes. This could allow unauthorized users to disable safety boundaries, potentially leading to full system compromise or unauthorized data access.
Technical details
A command injection vulnerability exists in OpenHarness due to insufficient authorization checks in the gateway handler (CWE-862). The application fails to properly isolate administrative 'slash commands' (like /permissions) from remote chat interfaces, treating them as safe for remote execution by default. A remote attacker with low-privileged chat access can send specially crafted messages to invoke these commands, effectively escalating their privileges to modify the running instance's configuration or safety modes. The vulnerability was addressed in commit dd1d235 by implementing a default-deny policy for administrative commands and requiring an explicit opt-in allowlist for remote administrative access.
Affected products
- HKUDS OpenHarness prior to commit dd1d235450dd987b20bff01b7bfb02fe8620a0af
Timeline
- 2026-04-12: other: Vulnerability reported via GitHub Pull Request #127
- 2026-04-13: patched: Fix committed to main branch (dd1d235)
- 2026-04-16: disclosed: CVE published to NVD