Ai Sdk Harness Codex
Monthly
Incorrect authorization in Vercel's @ai-sdk/harness-codex package (prior to 1.0.29) allows untrusted code executing inside a Codex CLI sandbox to invoke arbitrary host-exposed tools - including secret lookups, deployment operations, and cloud API calls - without a corresponding model-authorized tool-call event. The relay server validates incoming requests solely by checking whether the requesting process's command line contains the Codex CLI shim path via Linux /proc, a condition any sandbox process can trivially forge by including the shim path in its own argv. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the supply-chain threat vector via malicious npm lifecycle hooks or build scripts is realistic for developer environments processing untrusted repositories.
Incorrect authorization in Vercel's @ai-sdk/harness-codex package (prior to 1.0.29) allows untrusted code executing inside a Codex CLI sandbox to invoke arbitrary host-exposed tools - including secret lookups, deployment operations, and cloud API calls - without a corresponding model-authorized tool-call event. The relay server validates incoming requests solely by checking whether the requesting process's command line contains the Codex CLI shim path via Linux /proc, a condition any sandbox process can trivially forge by including the shim path in its own argv. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the supply-chain threat vector via malicious npm lifecycle hooks or build scripts is realistic for developer environments processing untrusted repositories.