CVE-2026-56696: OpenHarness remote project-context commands allow persistent prompt poisoning

June 23, 2026 (updated September 4, 2026)

OpenHarness /issue and /pr_comments slash commands lack remote_invocable=False protection, allowing remote channel senders to write attacker-controlled Markdown into project context files. Admitted remote attackers can inject malicious content into .openharness/issue.md and .openharness/pr_comments.md files, which are subsequently injected into runtime system prompts, persistently influencing local agent behavior.

References

github.com/HKUDS/OpenHarness/commit/27bb93b810e9ea8fa4832eab7152eeb3b4a6bffb
github.com/HKUDS/OpenHarness/pull/272
github.com/advisories/GHSA-24cw-228q-3rx9
nvd.nist.gov/vuln/detail/CVE-2026-56696
www.vulncheck.com/advisories/openharness-prompt-injection-via-issue-and-pr-comments-slash-commands

Code Behaviors & Features

Detect and mitigate CVE-2026-56696 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →