HKUDS OpenHarness contains a remote code execution vulnerability in the /bridge slash command that allows remote senders accepted by configuration to execute arbitrary operating system commands. The flaw is an OS command injection (CWE‑78) that forwards attacker‑controlled command text to a shared shell subprocess helper, enabling the attacker to spawn shell sessions as the OpenHarness process user and access local files, credentials, workspace state, and repository contents.

The affected product is OpenHarness by HKUDS. No specific version numbers are listed in the advisory, so any installation of OpenHarness that includes the /bridge feature and accepts remote slash commands may be vulnerable.

The CVSS score of 8.7 reflects the high impact of the flaw. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet. It is inferred that the attack vector is remote, requiring an attacker to be able to send slash commands that the system accepts – typically via a chat interface, API, or other communication channel. If the system is configured to receive such commands from external senders, the attacker can exploit the injected commands to gain local file access, credential theft, and modify repository contents.