{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-64650 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-64650 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-64650 is a medium-severity authentication bypass vulnerability in vercel @ai-sdk/harness-codex, published on 20 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-64650 and fix it if it is affected.\n\nWhat it is: CVE-2026-64650 is a medium-severity authentication bypass vulnerability in vercel @ai-sdk/harness-codex, published on 20 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-64650 in the wild and no public exploit code.\n\nAffected product: vercel @ai-sdk/harness-codex. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-64650/ (Markdown: https://insights.sbomify.com/CVE-2026-64650/index.md)","id":"CVE-2026-64650","markdown":"https://insights.sbomify.com/CVE-2026-64650/index.md","name":"CVE-2026-64650","record":{"aliases":["GHSA-qw9h-448j-6rph"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["privilege_escalation","data_read"],"network_reachable":"adjacent_or_local","non_default_config":true,"product_category":"AI SDK Codex Harness","requires_auth":"none","summary":"Untrusted sandbox code can bypass authorization to invoke host tools, enabling secret access and cloud operations in AI SDK Codex Harness.","user_interaction":"not_required","vuln_class":"auth_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":6.3,"severity":"medium","source":"cna","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:N","version":"4.0"},"cwes":[{"id":"CWE-863","name":"Incorrect Authorization"}],"description":"The `@ai-sdk/harness-opencode` tool is an HarnessV1 adapter backed by @openai/codex-sdk, which drives the codex command line interface. Prior to version 1.0.29, the tool relay authorizes requests from any process whose command line contains an allowed helper script path (the Codex CLI shim). This allows untrusted code executing in the sandbox to invoke arbitrary host-exposed tools, including secret lookups, deployment operations, and cloud API calls  without a corresponding model-authorized tool-call event. Exploitation requires a Linux environment (the vulnerable fallback checks `process.platform === 'linux'` and reads `/proc`); an active harness session with one or more host-provided tools; and untrusted code executing in the sandbox (e.g. a malicious dependency, build script, or lifecycle hook) The fix in version 1.0.29 removes the process-path authorization fallback entirely. Relay requests are now only accepted after exact, short-lived, one-time authorization matching the tool name and input from a bridge-observed model event. Some workarounds are available. Do not run the Codex harness on untrusted repositories or with untrusted dependencies, and/or limit host-exposed tools to non-sensitive operations when working with untrusted code.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"AI SDK Codex Harness Tool Relay Authorization Bypass","id":"CVE-2026-64650","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"auth_bypass","year":"2026"},"n_packages":0,"n_references":2,"next":{"headline":"AI SDK OpenCode Harness Tool Relay Authorization Bypass","id":"CVE-2026-64651"},"packages":[],"prev":{"headline":"Next.js: Server-Side Request Forgery in Server Actions on Custom Servers","id":"CVE-2026-64649"},"products":["@ai-sdk/harness-codex"],"published":"2026-07-20","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-07-20","vendors":["vercel"]},"summary":"Untrusted sandbox code can bypass authorization to invoke host tools, enabling secret access and cloud operations in AI SDK Codex Harness.","url":"https://insights.sbomify.com/CVE-2026-64650/"}