CVE-2026-7551

Katalog CVE

CVSS 8.8 · High EPSS 1,0%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada hkuds openharness. Skor CVSS 3.1 8.8 (High) menurut vulncheck.com.

Deskripsi (NVD)

HKUDS OpenHarness contains a remote code execution vulnerability in the /bridge slash command that allows remote senders accepted by configuration to execute arbitrary operating system commands. Attackers can invoke the /bridge spawn command with attacker-controlled command text that is forwarded to the bridge session manager and executed through the shared shell subprocess helper, allowing them to spawn shell sessions as the OpenHarness process user and access local files, credentials, workspace state, and repository contents.

Rincian

Terbit di NVD

30 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

1,0% peluang dieksploitasi; lebih tinggi dari 62,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/HKUDS/OpenHarness/commit/438e37309778e19060dfe7b172eb142e543c4cd6 patch
• https://github.com/HKUDS/OpenHarness/pull/208 exploit · issue tracking · patch · advisory pihak ketiga
• https://www.vulncheck.com/advisories/hkuds-openharness-remote-command-execution-via-bridge-slash-command advisory pihak ketiga