CVE-2026-56696: HKUDS OpenHarness prompt injection via slash commands

CVE-2026-56696 · Severity: medium · CVSS 5.4 · Published 2026-06-23

OpenHarness is an AI agent framework that allows users to manage project context through slash commands. An attacker with access to a remote channel can inject malicious Markdown into project context files (/issue and /pr_comments commands), which are later loaded into the AI agent's system prompts. This persistent poisoning causes the agent to act on attacker-supplied instructions on all future interactions, compromising the integrity of agent behavior and potentially leading to unintended actions.

Technologies: HKUDS OpenHarness. Vendors: HKUDS, PyPI.

Quick answers

Is CVE-2026-56696 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-56696 being exploited in the wild.
How severe is CVE-2026-56696?
Medium severity, with a CVSS score of 5.4, published 23 June 2026.
Which products and versions are affected?
HKUDS OpenHarness <= 0.1.9; openharness-ai (PyPI) <= 0.1.9, ECOSYSTEM:introduced=0,last_affected=0.1.9.
Is there a fix for CVE-2026-56696?
A patch was published on 2026-05-24: Fix merged in PR #272 (27bb93b); no patched release yet available Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56696 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-56696?
Check whether you run HKUDS OpenHarness or openharness-ai (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a missing authorization check (CWE-862) in the OpenHarness slash command dispatch layer. The /issue and /pr_comments commands inherited the default remote_invocable=True behavior without explicit override, allowing remote gateway messages to reach the command handlers. These handlers write user-supplied Markdown directly into .openharness/issue.md and .openharness/pr_comments.md files. Since these files are later injected into runtime system prompts as project context, an admitted remote channel sender can persistently influence local agent behavior through prompt injection. Attack vector is network-based and requires low privilege (authenticated remote channel access). The fix, merged in May 2026, marks both commands as local-only (remote_invocable=False) by default while preserving optional remote-admin opt-in for trusted deployments. No patched version is yet available for versions ≤ 0.1.9.

Affected products

  • HKUDS OpenHarness <= 0.1.9

Identifiers

  • CVE-2026-56696
  • GHSA-24cw-228q-3rx9
  • PYSEC-2026-3880

Timeline

  • 2026-06-23: disclosed
  • 2026-06-23: advisory: GitHub Advisory published
  • 2026-05-24: patched: Fix merged in PR #272 (27bb93b); no patched release yet available

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.