Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The `@ai-sdk/harness-opencode` tool connects HarnessAgent to OpenCode through a sandboxed bridge. Prior to version 1.0.28, the tool relay authorizes requests from any process whose command line contains an allowed helper script path (`host-tool-mcp.mjs`). This allows untrusted code executing in the sandbox to invoke arbitrary host-exposed tools including secret lookups, deployment operations, and cloud API calls without a corresponding model-authorized tool-call event. Exploitation requires a Linux environment (the vulnerable fallback checks `process.platform === 'linux'` and reads `/proc`); an active harness session with one or more host-provided tools; and untrusted code executing in the sandbox (e.g. a malicious dependency, build script, or lifecycle hook) The fix in version 1.0.28 removes the process-path authorization fallback entirely. Relay requests are now only accepted after exact, short-lived, one-time authorization matching the tool name and input from a bridge-observed model event. Some workarounds are available. Do not run the OpenCode harness on untrusted repositories or with untrusted dependencies, and/or limit host-exposed tools to non-sensitive operations when working with untrusted code.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
The Hacker News, August 6. CoreBreak. CVE-2026-18830, CVE-2026-18236, CVE-2026-64650, CVE-2026-64651. Fixes shipped. The class did not. https://thehackernews.com/2026/08/aws-google-and-vercel-patch-agent-flaws.html
🚨*CVE* CVE-2026-64651 The `@ai-sdk/harness-opencode` tool connects HarnessAgent to OpenCode through a sandboxed bridge. Prior to version 1.0.28, the tool relay authorizes requests from any… https://www.cve.org/CVERecord?id=CVE-2026-64651 ----- Traducción: CVE-2026-64651 La … http://infoflow.cloud`
Post summary
The tweet announces CVE‑2026‑64651, noting that the @ai-sdk/harness-opencode tool allowed unrestricted request authorization before version 1.0.28. It provides basic vulnerability details but no PoC or exploit evidence.
CVE-2026-64651 The `@ai-sdk/harness-opencode` tool connects HarnessAgent to OpenCode through a sandboxed bridge. Prior to version 1.0.28, the tool relay authorizes requests from any… https://www.cve.org/CVERecord?id=CVE-2026-64651
Post summary
The CVE-2026-64651 vulnerability involves the `@ai-sdk/harness-opencode` tool allowing unauthorized request authorization before version 1.0.28, with the implication that the issue is remedied in later releases.