CVE-2026-64651 Details

A vulnerability exists in the @ai-sdk/harness-opencode tool prior to version 1.0.28, allowing for an authorization bypass in the tool relay. The issue arises because the relay accepts requests from any process whose command line includes a specified helper script path. This flaw enables untrusted code running in a sandboxed environment to execute arbitrary host-exposed tools. Such actions could include accessing secrets, performing deployment tasks, and making cloud API calls, all without the necessary model-authorized tool-call event. The vulnerability is present in Linux environments, where the fallback checks for the platform and reads from the process directory. Exploitation requires an active harness session with host-provided tools and untrusted code in the sandbox, such as a malicious dependency or build script.

Users are advised to upgrade to version 1.0.28 or later. The update removes the problematic process-path authorization fallback and requires precise, short-lived, one-time authorization for relay requests. Additionally, avoid running the OpenCode harness on untrusted repositories or with untrusted dependencies, and restrict host-exposed tools to non-sensitive tasks when dealing with untrusted code.