The @ai-sdk/harness‑opencode tool used by Vercel connects a HarnessAgent to OpenCode through a sandboxed bridge. Before version 1.0.28, the relay component would authorize any process whose command line contained an allowed helper script path (host‑tool‑mcp.mjs). This permitted untrusted code running inside the sandbox to invoke arbitrary host‑exposed tools, including secret lookups, deployment operations, and cloud API calls, without a corresponding model‑authorized tool‑call event. The flaw is an improper authorization check (CWE‑863) with a CVSS score of 6.3.

Vercel’s @ai-sdk/harness‑opencode library, versions prior to 1.0.28, is vulnerable when deployed on Linux. The vulnerability requires an active harness session that includes one or more host‑provided tools and that untrusted code is executing within the sandbox, for example via a malicious dependency, build script or lifecycle hook.

The overall risk is moderate because the CVSS score is 6.3, the EPSS score is less than 1%, and the flaw is not listed in the CISA KEV catalog. Exploitation would allow an attacker to perform privileged actions on the host, such as accessing secrets or triggering deployments, without generating a legitimate model‑authorized tool‑call event. Exploitability requires a Linux host with the vulnerable bridge, an active harness session, host‑provided tools and the presence of untrusted code inside the sandbox. The official fix in v1.0.28 removes the process‑path fallback and requires a short‑lived, one‑time authorization for each tool call.