The bug allows an attacker who can influence the execution of built‑in file tools to read or write files outside the intended repository, because the path argument is omitted from the PermissionChecker in read_file, write_file, edit_file, and notebook_edit tools. This can expose configuration files, credentials, SSH private keys, or allow the attacker to create or overwrite files in privileged host locations, especially when the full_auto mode is enabled. The consequence is loss of confidentiality and integrity, and potentially the ability to modify system state or elevate privileges.

OpenHarness versions prior to commit 166fcfe are affected. The vulnerability applies to any installation of the HKUDS:OpenHarness product where the file tools are available and unpatched.

The vulnerability carries a CVSS score of 8.4, indicating high severity. EPSS information is not available, and it is not listed in the CISA KEV catalog. Exploitation requires the attacker to be able to influence the agent tool execution, which typically means having authenticated control over the harness or exploiting a misconfiguration that exposes the tools to untrusted input. The potential impact is significant, especially if the harness is reachable from untrusted networks, leading to data exposure and potential system compromise.