CVE-2026-40516

The /issue and /pr_comments slash commands in OpenHarness lack remote_invocable=False protection, allowing remote senders to inject attacker-controlled Markdown into project context files.

A permission bypass vulnerability in OpenHarness before commit bd4df81 allows attackers to read sensitive files by exploiting incomplete path normalization. Attackers can use built-in grep and glob tools with sensitive root directories not properly evaluated against configured path rules, leading to disclosure of local file content, key material, configuration files, or directory contents.

A path traversal vulnerability in OpenHarness prior to commit dd1d235 allows remote gateway users with chat access to read arbitrary files by supplying path traversal sequences to the /memory show slash command. Attackers can bypass the project memory directory validation and access sensitive files accessible to the OpenHarness process.

OpenHarness prior to commit dd1d235 contains a command injection vulnerability that allows remote gateway users with chat access to invoke sensitive administrative commands by exploiting insufficient distinction between local-only and remote-safe commands in the gateway handler. Attackers can execute administrative commands such as /permissions full_auto through remote chat sessions to change permission modes of a running OpenHarness instance without operator authorization.

OpenHarness prior to commit 166fcfe contains an improper access control vulnerability in built-in file tools due to inconsistent parameter handling in permission enforcement. This allows attackers who can influence agent tool execution to read arbitrary local files outside the intended repository scope.