CVE-2026-64650 Overview
CVE-2026-64650 is an authorization bypass vulnerability [CWE-863] in the @ai-sdk/harness-opencode package, a HarnessV1 adapter backed by @openai/codex-sdk that drives the Codex command line interface. Versions prior to 1.0.29 authorize relay requests based solely on whether a calling process command line contains an allowed helper script path. Untrusted code running inside the Codex sandbox can invoke arbitrary host-exposed tools, including secret lookups, deployment operations, and cloud API calls, without any model-authorized tool-call event. The flaw carries a CVSS 4.0 score of 6.3 (MEDIUM) and requires local access on Linux.
Critical Impact
Malicious dependencies or build scripts executing in the sandbox can invoke sensitive host tools (secret access, deployments, cloud APIs) that were only intended for model-authorized invocation.
Affected Products
- @ai-sdk/harness-opencode versions prior to 1.0.29
- Deployments using the @openai/codex-sdk Codex CLI shim on Linux hosts
- Harness sessions that expose host-provided tools to the sandbox
Discovery Timeline
- 2026-07-20 - CVE-2026-64650 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-64650
Vulnerability Analysis
The @ai-sdk/harness-opencode relay mediates tool invocations between the Codex sandbox and host-exposed capabilities. Under normal operation, relay requests are supposed to correspond to model-authorized tool-call events observed by the bridge. The vulnerable code path introduces a fallback authorization mechanism that inspects the calling process on Linux.
When process.platform === 'linux', the relay reads /proc to obtain the command line of the requesting process. If that command line contains the path of an allowed helper script (the Codex CLI shim), the relay treats the request as authorized. Any process able to spawn itself with a command line referencing the shim path satisfies this check, defeating the intended tool-call binding.
The scope of accessible operations is defined by the harness session configuration. Where sessions expose secret lookups, deployment triggers, or cloud API wrappers, an attacker inside the sandbox can invoke those tools directly.
Root Cause
The root cause is an improper authorization decision that treats process-path substring matching as proof of caller identity. Command line contents are attacker-controllable within the sandbox and provide no cryptographic or contextual guarantee that a request originated from a legitimate model-driven event.
Attack Vector
Exploitation requires three conditions: a Linux host, an active harness session with host-provided tools, and untrusted code running inside the sandbox. The untrusted code may be delivered through a malicious npm dependency, a build script, or an npm lifecycle hook. Once executing, the code launches a helper process whose command line references the Codex CLI shim path, then issues relay requests for any host-exposed tool. No model event is required, and no user interaction is needed.
See the GitHub Security Advisory GHSA-qw9h-448j-6rph for full technical details.
Detection Methods for CVE-2026-64650
Indicators of Compromise
- Processes within a Codex sandbox spawning child processes whose argv includes the Codex CLI shim path but that were not launched by the harness bridge.
- Relay tool invocations (secret reads, deployment triggers, cloud API calls) that lack a corresponding preceding model tool-call event in bridge logs.
- Unexpected reads of /proc/<pid>/cmdline originating from sandboxed workloads.
Detection Strategies
- Correlate relay request logs with bridge-observed model events and flag any relay call that has no matching authorization record.
- Inventory installed versions of @ai-sdk/harness-opencode across CI runners and developer workstations and alert on versions earlier than 1.0.29.
- Audit npm lifecycle scripts and build tooling in repositories processed by the Codex harness for suspicious process spawning.
Monitoring Recommendations
- Enable verbose logging on the harness relay to capture tool name, input parameters, and authorization source for every accepted request.
- Monitor outbound calls to secret stores and cloud control planes originating from harness sessions and baseline expected volumes.
- Track process creation events on Linux hosts running the Codex CLI, focusing on unexpected invocations referencing the shim path.
How to Mitigate CVE-2026-64650
Immediate Actions Required
- Upgrade @ai-sdk/harness-opencode to version 1.0.29 or later across all environments that run the Codex harness.
- Stop running the Codex harness against untrusted repositories, dependencies, or branches until the upgrade is complete.
- Rotate any secrets, tokens, or cloud credentials that were reachable through host-exposed tools during the exposure window.
Patch Information
Version 1.0.29 removes the process-path authorization fallback entirely. Relay requests are accepted only after an exact, short-lived, one-time authorization that matches both the tool name and input from a bridge-observed model event. Review the fix in the Vercel AI Pull Request #17105.
Workarounds
- Do not run the Codex harness on untrusted repositories or with untrusted dependencies.
- Restrict host-exposed tools to non-sensitive operations when working with code of unknown provenance.
- Isolate harness sessions in ephemeral environments with no persistent credentials or production network reachability.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
