vercel Vulnerabilities and Affected Products
Vulnerabilities associated with @ai-sdk/harness-codex.
Products
Clear product- next.js48 vulnerabilities
- ai3 vulnerabilities
- turborepo3 vulnerabilities
- ms2 vulnerabilities
- next2 vulnerabilities
- @ai-sdk/harness-codex1 vulnerability
- @ai-sdk/harness-opencode1 vulnerability
- AI SDK1 vulnerability
- flags1 vulnerability
- hyper1 vulnerability
- Nuxt Devtools1 vulnerability
- pkg1 vulnerability
- vercel1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-64650MEDIUM | AI SDK Codex Harness Tool Relay Authorization BypassThe `@ai-sdk/harness-opencode` tool is an HarnessV1 adapter backed by @openai/codex-sdk, which drives the codex command line interface. Prior to version 1.0.29, the tool relay authorizes requests from any process whose command line contains an allowed helper script path (the Codex CLI shim). This allows untrusted code executing in the sandbox to invoke arbitrary host-exposed tools, including secret lookups, deployment operations, and cloud API calls without a corresponding model-authorized tool… CWE-863Jul 20, 2026 | CVSS6.3v4.0 | EPSS0.113% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |