Incorrect Authorization@ai-sdk/harness-opencode is a The OpenCode harness connects HarnessAgent to OpenCode through a sandboxed bridge.
Affected versions of this package are vulnerable to Incorrect Authorization through the tool relay in tool-relay-auth.ts and tool-relay.ts. An attacker can invoke host-exposed tools, including sensitive lookups and cloud operations, by sending a relay request from sandboxed code whose process command line contains the allowed helper script path. The vulnerable relay accepted requests on Linux based on /proc process inspection instead of a matching model-authorized tool call, so untrusted code running inside the harness could reach the host tool server without a corresponding authorization event. This breaks the harness’s tool-use controls and can expose secrets or trigger unintended host-side actions for users running the harness with untrusted repositories or dependencies.
Notes
- Linux-only fallback authorization depended on
/proc process and socket inspection, so the bypass was specific to hosts where the harness could read /proc and correlate the relay connection back to a process command line.
- The vulnerable path was gated on the relay session’s configured helper script allowlist (
host-tool-mcp.mjs / CLI shim path), which meant any sandboxed code able to invoke that helper path inside the same harness session could satisfy the check.
Workarounds
- Do not run the OpenCode harness on untrusted repositories or with untrusted dependencies; this prevents sandboxed code from reaching the host relay through malicious build scripts, lifecycle hooks, or dependencies.
- Limit host-exposed tools to non-sensitive operations when using untrusted code; this reduces what an attacker can do if they trigger tool relay access.
How to fix Incorrect Authorization? Upgrade @ai-sdk/harness-opencode to version 1.0.29 or higher.
| |
