Is there a patch available for CVE-2026-64650?

Yes, a patch is available for CVE-2026-64650. Update the affected software to the latest version immediately.

@ai-sdk/harness-codex CVE-2026-64650

Q: What is the CVSS score of CVE-2026-64650?

CVE-2026-64650 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-46102 MEDIUM

Incorrect Authorization (CWE-863)

2026-07-20 GitHub_M

Authentication Bypass Vercel Ai Sdk Harness Codex

6.3

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.0 CRITICAL

Local vector (sandbox code execution required), scope changed to host, high confidentiality and integrity impact on host tools; no availability impact described.

3.1 AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 20, 2026 - 23:18 EUVD

Source Code Evidence Fetched

Jul 20, 2026 - 21:35 vuln.today

Analysis Generated

Jul 20, 2026 - 21:35 vuln.today

CVE Published

Jul 20, 2026 - 20:27 cve.org

MEDIUM 6.3

DescriptionCVE.org

The @ai-sdk/harness-opencode tool is an HarnessV1 adapter backed by @openai/codex-sdk, which drives the codex command line interface. Prior to version 1.0.29, the tool relay authorizes requests from any process whose command line contains an allowed helper script path (the Codex CLI shim). This allows untrusted code executing in the sandbox to invoke arbitrary host-exposed tools, including secret lookups, deployment operations, and cloud API calls without a corresponding model-authorized tool-call event. Exploitation requires a Linux environment (the vulnerable fallback checks process.platform === 'linux' and reads /proc); an active harness session with one or more host-provided tools; and untrusted code executing in the sandbox (e.g. a malicious dependency, build script, or lifecycle hook) The fix in version 1.0.29 removes the process-path authorization fallback entirely. Relay requests are now only accepted after exact, short-lived, one-time authorization matching the tool name and input from a bridge-observed model event. Some workarounds are available. Do not run the Codex harness on untrusted repositories or with untrusted dependencies, and/or limit host-exposed tools to non-sensitive operations when working with untrusted code.

AnalysisAI

Incorrect authorization in Vercel's @ai-sdk/harness-codex package (prior to 1.0.29) allows untrusted code executing inside a Codex CLI sandbox to invoke arbitrary host-exposed tools - including secret lookups, deployment operations, and cloud API calls - without a corresponding model-authorized tool-call event. The relay server validates incoming requests solely by checking whether the requesting process's command line contains the Codex CLI shim path via Linux /proc, a condition any sandbox process can trivially forge by including the shim path in its own argv. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the supply-chain threat vector via malicious npm lifecycle hooks or build scripts is realistic for developer environments processing untrusted repositories.

Technical ContextAI

The @ai-sdk/harness-codex package (CPE: cpe:2.3:a:vercel:@ai-sdk/harness-codex) is a HarnessV1 adapter that bridges the @openai/codex-sdk CLI to host-side tools over a local TCP relay socket. The root cause is CWE-863 (Incorrect Authorization): the relay's process-path allowlist reads /proc on Linux to inspect the argv of the requesting process and checks whether it contains the path of the Codex CLI shim. Because any process can place an arbitrary string in its own command-line arguments, untrusted sandbox code can spoof this check without any actual relationship to the shim binary. The PR #17105 diff confirms the fix removes the isToolRelayRequestFromAllowedProcess and ToolRelayAuthorizer components entirely, replacing them with startAuthorizedToolRelay which requires cryptographically-paired, short-lived, one-time authorization tokens tied to specific bridge-observed model-event observations - meaning the host relay only accepts a tool call if it has already seen the model emit that exact tool name and input.

RemediationAI

Upgrade @ai-sdk/harness-codex (and @ai-sdk/harness-opencode if used) to version 1.0.29 or later - the vendor-released patch per GitHub advisory GHSA-qw9h-448j-6rph and PR #17105 (https://github.com/vercel/ai/pull/17105). The fix replaces the flawed process-path authorization with cryptographically-tied one-time tokens, eliminating the bypass class entirely. If an immediate upgrade is not possible, two vendor-recommended workarounds exist: first, do not run the Codex harness on untrusted repositories or with untrusted dependencies, which removes the attacker's code-execution primitive in the sandbox; second, limit host-exposed tools to non-sensitive operations (i.e., exclude secret lookups, deployment triggers, and cloud API calls) when working with untrusted code, which reduces the impact of a successful bypass to non-critical operations. The second workaround degrades harness functionality and requires ongoing operational discipline to maintain - neither workaround is enforceable at the code level and both rely on correct developer behavior.