https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-09-30T11:37:36.439467+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-56696 CVE-2026-56696 — OpenHarness - Prompt Injection via /issue and /pr_comments Slash Commands 2026-09-30T11:37:36.441563+00:00

Affected: HKUDS OpenHarness

OpenHarness /issue and /pr_comments slash commands lack remote_invocable=False protection, allowing remote channel senders to write attacker-controlled Markdown into project context files. Admitted remote attackers can inject malicious content into .openharness/issue.md and .openharness/pr_comments.md files, which are subsequently injected into runtime system prompts, persistently influencing local agent behavior.

 https://db.gcve.eu/vuln/pysec-2026-3880 PYSEC-2026-3880 — OpenHarness remote project-context commands allow persistent prompt poisoning 2026-09-30T11:37:36.441676+00:00

Affected: PyPI: openharness-ai

OpenHarness /issue and /pr_comments slash commands lack remote_invocable=False protection, allowing remote channel senders to write attacker-controlled Markdown into project context files. Admitted remote attackers can inject malicious content into .openharness/issue.md and .openharness/pr_comments.md files, which are subsequently injected into runtime system prompts, persistently influencing local agent behavior.