Executive brief
A security flaw in the Vercel AI SDK OpenCode harness allows untrusted code to bypass security sandboxes. This could allow a malicious script or dependency to perform unauthorized actions on the host system, such as accessing secret keys, deploying software, or making cloud API calls. The issue primarily affects developers running AI-driven tools on Linux environments when interacting with untrusted repositories.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in @ai-sdk/harness-opencode prior to version 1.0.28. The tool relay incorrectly authorizes requests by checking if a process's command line contains a specific helper script path ('host-tool-mcp.mjs') via /proc on Linux. An attacker with the ability to execute code within the sandbox (e.g., via a malicious dependency or build script) can spoof this condition to invoke host-exposed tools like secret lookups or cloud APIs without a model-authorized event. The fix removes this process-path fallback in favor of a short-lived, one-time authorization token matching specific model events.
Affected products
- Vercel @ai-sdk/harness-opencode <= 1.0.27
Timeline
- 2026-07-10: patched: Fix merged in GitHub pull request #17105
- 2026-07-20: advisory: GitHub Security Advisory GHSA-g48p-5rr5-8rgq published
- 2026-07-20: disclosed: CVE-2026-64651 published to NVD