Vulnerability Description
The `@ai-sdk/harness-opencode` tool is an HarnessV1 adapter backed by @openai/codex-sdk, which drives the codex command line interface. Prior to version 1.0.29, the tool relay authorizes requests from any process whose command line contains an allowed helper script path (the Codex CLI shim). This allows untrusted code executing in the sandbox to invoke arbitrary host-exposed tools, including secret lookups, deployment operations, and cloud API calls without a corresponding model-authorized tool-call event. Exploitation requires a Linux environment (the vulnerable fallback checks `process.platform === 'linux'` and reads `/proc`); an active harness session with one or more host-provided tools; and untrusted code executing in the sandbox (e.g. a malicious dependency, build script, or lifecycle hook) The fix in version 1.0.29 removes the process-path authorization fallback entirely. Relay requests are now only accepted after exact, short-lived, one-time authorization matching the tool name and input from a bridge-observed model event. Some workarounds are available. Do not run the Codex harness on untrusted repositories or with untrusted dependencies, and/or limit host-exposed tools to non-sensitive operations when working with untrusted code.
Related Weaknesses (CWE)
References
- https://github.com/vercel/ai/pull/17105
- https://github.com/vercel/ai/security/advisories/GHSA-qw9h-448j-6rph
FAQ
What is CVE-2026-64650?
CVE-2026-64650 is a documented vulnerability. The `@ai-sdk/harness-opencode` tool is an HarnessV1 adapter backed by @openai/codex-sdk, which drives the codex command line interface. Prior to version 1.0.29, the tool relay authorizes requests from...
How severe is CVE-2026-64650?
CVSS scoring is not yet available for CVE-2026-64650. Check NVD for updates.
Is there a patch for CVE-2026-64650?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.