CVE-2026-64650 Details

An authorization bypass vulnerability has been identified in the `@ai-sdk/harness-opencode` tool, which serves as an adapter for HarnessV1, utilizing the OpenAI Codex SDK. This vulnerability exists in versions prior to 1.0.29. The issue arises because the tool improperly authorizes requests from processes whose command line includes a permitted helper script path, known as the Codex CLI shim. As a result, untrusted code running in a sandboxed environment can execute arbitrary host-exposed tools. This includes accessing secrets, performing deployment tasks, and making cloud API calls, all without the necessary model-authorized tool-call event. Exploitation of this vulnerability requires a Linux environment, an active Harness session with host-provided tools, and untrusted code in the sandbox, such as a malicious dependency or build script.

Users are advised to upgrade to version 1.0.29 or later, where this vulnerability has been patched. The fix involves removing the process-path authorization fallback and requiring exact, short-lived, one-time authorization that matches the tool name and input from a model event. Additionally, do not run the Codex harness on untrusted repositories or with untrusted dependencies, and limit host-exposed tools to non-sensitive operations when working with untrusted code.