CVE-2026-64650

Name of the Vulnerable Software and Affected Versions @ai-sdk/harness-opencode versions prior to 1.0.29

Description The tool relay authorizes requests from any process whose command line contains an allowed helper script path. This allows untrusted code executing in the sandbox to invoke arbitrary host-exposed tools, such as secret lookups, deployment operations, and cloud API calls, without a model-authorized tool-call event. Exploitation requires a Linux environment, an active harness session with host-provided tools, and untrusted code executing in the sandbox, such as a malicious dependency, build script, or lifecycle hook. Real-world incidents of this issue being exploited have been reported.

Recommendations Update to version 1.0.29 or later. Do not run the Codex harness on untrusted repositories or with untrusted dependencies. Limit host-exposed tools to non-sensitive operations when working with untrusted code.