CVE-2026-64651

Received Received - Intake

Unauthorized Tool Invocation in @ai-sdk/harness-opencode

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description

The `@ai-sdk/harness-opencode` tool connects HarnessAgent to OpenCode through a sandboxed bridge. Prior to version 1.0.28, the tool relay authorizes requests from any process whose command line contains an allowed helper script path (`host-tool-mcp.mjs`). This allows untrusted code executing in the sandbox to invoke arbitrary host-exposed tools including secret lookups, deployment operations, and cloud API calls without a corresponding model-authorized tool-call event. Exploitation requires a Linux environment (the vulnerable fallback checks `process.platform === 'linux'` and reads `/proc`); an active harness session with one or more host-provided tools; and untrusted code executing in the sandbox (e.g. a malicious dependency, build script, or lifecycle hook) The fix in version 1.0.28 removes the process-path authorization fallback entirely. Relay requests are now only accepted after exact, short-lived, one-time authorization matching the tool name and input from a bridge-observed model event. Some workarounds are available. Do not run the OpenCode harness on untrusted repositories or with untrusted dependencies, and/or limit host-exposed tools to non-sensitive operations when working with untrusted code.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-20

Last Modified

2026-07-20

Generated

2026-07-21

AI Q&A

2026-07-21

EPSS Evaluated

N/A

NVD

CVE-2026-64651

Affected Vendors & Products

Vendor	Product	Version / Range
ai-sdk	harness-opencode	to 1.0.28 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the @ai-sdk/harness-opencode tool before version 1.0.28. It allows untrusted code in a sandbox to bypass authorization and invoke host-exposed tools like secret lookups or cloud API calls without proper model-authorized tool calls. The issue stems from a process-path authorization fallback that checks command lines for allowed helper scripts.

Detection Guidance

Detection requires checking the installed version of @ai-sdk/harness-opencode. Run: npm list @ai-sdk/harness-opencode. If the version is below 1.0.28, the system is vulnerable. Additionally, inspect process command lines for unauthorized tool invocations on Linux systems by examining /proc entries.

Impact Analysis

An attacker could exploit this to execute unauthorized actions on your system if they control code running in the sandbox, such as accessing sensitive data, modifying deployments, or making cloud API calls. This requires a Linux environment, an active harness session with host tools, and untrusted code in the sandbox.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Unauthorized secret lookups or cloud API calls may expose regulated data.

Mitigation Strategies

Upgrade @ai-sdk/harness-opencode to version 1.0.28 or later. Avoid running OpenCode harness on untrusted repositories or with untrusted dependencies. Limit host-exposed tools to non-sensitive operations when working with untrusted code.

Hi! I’m here to help you understand CVE-2026-64651. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70