CVE-2026-64651 vercel CVE debrief

Who should care

Defenders responsible for HarnessAgent and OpenCode deployments should assess exposure and prioritize upgrading to version 1.0.28 or later. They should also restrict HarnessAgent to trusted repositories and dependencies, and limit host-exposed tools to non-sensitive operations when working with untrusted code.

Why it matters

CVE-2026-64651 allows untrusted code in the AI SDK Harness OpenCode sandbox to bypass authorization and invoke host-exposed tools, potentially leading to secret access and API calls. Defenders should prioritize upgrading to version 1.0.28 or later, restrict HarnessAgent to trusted repositories, and limit host-exposed tools for untrusted code.

• Untrusted code execution in the sandbox can lead to arbitrary API calls and secret access
• Exploitation requires a Linux environment and active Harness session
• Defenders must verify and upgrade to version 1.0.28 or later
• Additional information on potential exploitation and impact is limited

Technical summary

The `@ai-sdk/harness-opencode` tool connects HarnessAgent to OpenCode through a sandboxed bridge. Prior to version 1.0.28, it incorrectly authorizes requests from any process with an allowed helper script path. This allows untrusted code execution in the sandbox to invoke arbitrary host-exposed tools, including secret lookups, deployment operations, and cloud API calls. Exploitation requires a Linux environment, an active Harness session, and untrusted code execution in the sandbox. The fix in version 1.0.28 removes the process-path authorization fallback entirely. Relay requests are now only accepted after exact, short-lived, one-time authorization matching the tool name and input from a bridge-observed model event.

Defensive priority

Defenders should prioritize upgrading to version 1.0.28 or later and restrict HarnessAgent to trusted repositories and dependencies.

Recommended defensive actions

• Upgrade to version 1.0.28 or later
• Restrict HarnessAgent to trusted repositories and dependencies
• Limit host-exposed tools to non-sensitive operations when working with untrusted code
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE description and source references provide details on the vulnerability and fix. Additional information on potential exploitation and impact is limited. Defenders should verify HarnessAgent deployments, assess exposure, and prioritize upgrading to version 1.0.28 or later. They should also restrict HarnessAgent to trusted repositories and dependencies, and limit host-exposed tools to non-sensitive operations when working with untrusted code. Evidence is based on CVE and NVD records, with limited additional context.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.