CVE-2026-64650

Received Received - Intake

Authorization Bypass in @ai-sdk/harness-opencode

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description

The `@ai-sdk/harness-opencode` tool is an HarnessV1 adapter backed by @openai/codex-sdk, which drives the codex command line interface. Prior to version 1.0.29, the tool relay authorizes requests from any process whose command line contains an allowed helper script path (the Codex CLI shim). This allows untrusted code executing in the sandbox to invoke arbitrary host-exposed tools, including secret lookups, deployment operations, and cloud API calls without a corresponding model-authorized tool-call event. Exploitation requires a Linux environment (the vulnerable fallback checks `process.platform === 'linux'` and reads `/proc`); an active harness session with one or more host-provided tools; and untrusted code executing in the sandbox (e.g. a malicious dependency, build script, or lifecycle hook) The fix in version 1.0.29 removes the process-path authorization fallback entirely. Relay requests are now only accepted after exact, short-lived, one-time authorization matching the tool name and input from a bridge-observed model event. Some workarounds are available. Do not run the Codex harness on untrusted repositories or with untrusted dependencies, and/or limit host-exposed tools to non-sensitive operations when working with untrusted code.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-20

Last Modified

2026-07-20

Generated

2026-07-21

AI Q&A

2026-07-21

EPSS Evaluated

N/A

NVD

CVE-2026-64650

Affected Vendors & Products

Vendor	Product	Version / Range
harness	v1_adapter	1.0.29
openai	codex_sdk	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

The vulnerability in @ai-sdk/harness-opencode before version 1.0.29 allows untrusted code in a sandbox to bypass authorization checks by exploiting a process-path fallback mechanism. This lets malicious code invoke host tools like secret lookups or cloud API calls without proper model authorization.

Detection Guidance

This vulnerability requires checking for the presence of the vulnerable @ai-sdk/harness-opencode tool version 1.0.29 or earlier. Inspect installed packages using commands like 'npm list @ai-sdk/harness-opencode' or 'yarn list @ai-sdk/harness-opencode'. If the tool is installed and the version is below 1.0.29, the system is vulnerable.

Impact Analysis

An attacker could execute unauthorized actions on your system if they control untrusted code in a sandboxed environment using this tool. This includes accessing sensitive data, modifying deployments, or making unintended cloud API calls.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Unauthorized tool execution may result in data breaches or non-compliance.

Mitigation Strategies

Upgrade the @ai-sdk/harness-opencode tool to version 1.0.29 or later to remove the vulnerable process-path authorization fallback. Avoid running the Codex harness on untrusted repositories or with untrusted dependencies. Limit host-exposed tools to non-sensitive operations when working with untrusted code.

Hi! I’m here to help you understand CVE-2026-64650. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70