AIKIDO-2026-412985

@ai-sdk/harness-opencode is vulnerable to Missing Authentication for Critical Function

Missing Authentication for Critical FunctionGHSA-vmqp-7rwf-cq3w Published 5 days ago

Medium Risk

This Affects:

@ai-sdk/harness-opencode

0.0.1 - 1.0.72

Fixed in 1.0.73

Are you affected? Scan for Free

TL;DR

The @ai-sdk/harness-opencode bridge starts OpenCode's loopback HTTP control server without authentication. Untrusted code running in the same sandbox can call that control API, inject a prompt into the active session, and cause the host HarnessAgent process to run caller declared host tools, including secret lookups, deployment operations, and cloud API calls. Exploitation requires an active harness session with one or more host provided tools and a non-interactive (default) approval policy for the targeted tool. The fix adds authentication to the loopback control server.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you run an OpenCode harness session with host provided tools under a non-interactive (default) approval policy.