Ai Sdk Harness Opencode
Monthly
Sandbox authorization bypass in Vercel's `@ai-sdk/harness-opencode` (all versions prior to 1.0.28) permits untrusted code executing inside the OpenCode sandbox to invoke arbitrary host-exposed tools — including secret lookups, deployment operations, and cloud API calls — without a corresponding model-authorized tool-call event. The flawed process-path fallback reads `/proc/<pid>/cmdline` on Linux to verify the requesting process's command line contains the `host-tool-mcp.mjs` script path, a check that sandboxed attacker-controlled code can satisfy or spoof. No public exploit code has been identified at time of analysis, and the issue is remediated in v1.0.28 by replacing the path check with short-lived one-time authorization tokens bound to bridge-observed model events.
Sandbox authorization bypass in Vercel's `@ai-sdk/harness-opencode` (all versions prior to 1.0.28) permits untrusted code executing inside the OpenCode sandbox to invoke arbitrary host-exposed tools — including secret lookups, deployment operations, and cloud API calls — without a corresponding model-authorized tool-call event. The flawed process-path fallback reads `/proc/<pid>/cmdline` on Linux to verify the requesting process's command line contains the `host-tool-mcp.mjs` script path, a check that sandboxed attacker-controlled code can satisfy or spoof. No public exploit code has been identified at time of analysis, and the issue is remediated in v1.0.28 by replacing the path check with short-lived one-time authorization tokens bound to bridge-observed model events.