Vulnerability in HarnessAgent Tool Affecting OpenCode by Vercel

CVE-2026-64651

What is CVE-2026-64651?

The @ai-sdk/harness-opencode tool serves as a connection between the HarnessAgent and OpenCode via a sandboxed bridge. Versions prior to 1.0.28 permit unauthorized relay authorizations from any process with a command line matching an accepted helper script path. This flaw exposes the system to risks where untrusted code running within a sandbox can execute host-exposed tools, including sensitive operations such as secret lookup and cloud API interactions. Exploitation necessitates specific conditions: a Linux environment, an active harness session with host tools, and the presence of untrusted code such as malicious dependencies or scripts. The remedial update in version 1.0.28 eliminates the insecure authorization fallback by ensuring that relay requests are only accepted after precise, one-time authorization corresponding to the tool name from a validated model event. It is recommended to avoid running the OpenCode harness with untrusted repositories or dependencies and to limit host-exposed tools to non-sensitive tasks in such environments.

References