CVE-2026-64651 PUBLISHED

AI SDK OpenCode Harness Tool Relay Authorization Bypass

Assigner: GitHub_M
Reserved: 20.07.2026 Published: 20.07.2026 Updated: 21.07.2026

The @ai-sdk/harness-opencode tool connects HarnessAgent to OpenCode through a sandboxed bridge. Prior to version 1.0.28, the tool relay authorizes requests from any process whose command line contains an allowed helper script path (host-tool-mcp.mjs). This allows untrusted code executing in the sandbox to invoke arbitrary host-exposed tools including secret lookups, deployment operations, and cloud API calls without a corresponding model-authorized tool-call event. Exploitation requires a Linux environment (the vulnerable fallback checks process.platform === 'linux' and reads /proc); an active harness session with one or more host-provided tools; and untrusted code executing in the sandbox (e.g. a malicious dependency, build script, or lifecycle hook) The fix in version 1.0.28 removes the process-path authorization fallback entirely. Relay requests are now only accepted after exact, short-lived, one-time authorization matching the tool name and input from a bridge-observed model event. Some workarounds are available. Do not run the OpenCode harness on untrusted repositories or with untrusted dependencies, and/or limit host-exposed tools to non-sensitive operations when working with untrusted code.

Metrics

CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:N
CVSS Score: 6.3

Product Status

Vendor vercel
Product @ai-sdk/harness-opencode
Versions
  • Version < 1.0.29 is affected

References

Problem Types

  • CWE-863: Incorrect Authorization CWE