Vulnerability Description
The `@ai-sdk/harness-opencode` tool connects HarnessAgent to OpenCode through a sandboxed bridge. Prior to version 1.0.28, the tool relay authorizes requests from any process whose command line contains an allowed helper script path (`host-tool-mcp.mjs`). This allows untrusted code executing in the sandbox to invoke arbitrary host-exposed tools including secret lookups, deployment operations, and cloud API calls without a corresponding model-authorized tool-call event. Exploitation requires a Linux environment (the vulnerable fallback checks `process.platform === 'linux'` and reads `/proc`); an active harness session with one or more host-provided tools; and untrusted code executing in the sandbox (e.g. a malicious dependency, build script, or lifecycle hook) The fix in version 1.0.28 removes the process-path authorization fallback entirely. Relay requests are now only accepted after exact, short-lived, one-time authorization matching the tool name and input from a bridge-observed model event. Some workarounds are available. Do not run the OpenCode harness on untrusted repositories or with untrusted dependencies, and/or limit host-exposed tools to non-sensitive operations when working with untrusted code.
Related Weaknesses (CWE)
References
- https://github.com/vercel/ai/pull/17105
- https://github.com/vercel/ai/security/advisories/GHSA-g48p-5rr5-8rgq
FAQ
What is CVE-2026-64651?
CVE-2026-64651 is a documented vulnerability. The `@ai-sdk/harness-opencode` tool connects HarnessAgent to OpenCode through a sandboxed bridge. Prior to version 1.0.28, the tool relay authorizes requests from any process whose command line contai...
How severe is CVE-2026-64651?
CVSS scoring is not yet available for CVE-2026-64651. Check NVD for updates.
Is there a patch for CVE-2026-64651?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.