AIKIDO-2026-688319

@ai-sdk/harness-opencode is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Exposure of Sensitive Information to an Unauthorized ActorGHSA-4mqq-99j3-3hmv Published 2 days ago

High Risk

This Affects:

@ai-sdk/harness-opencode

1.0.0 - 1.0.134

Fixed in 1.0.135

Are you affected? Scan for Free

TL;DR

AI SDK Harness adapters pass credentials into a sandbox by replacing real values with non-secret placeholders outside the sandbox boundary. When a session is resumed, the adapter reuses the placeholder map saved with the previous session instead of rebuilding it from the current authentication environment. A credential variable added after the session was first created is passed into the sandbox as its real value, so code or agent activity inside the resumed sandbox can read and exfiltrate it without escaping the sandbox. The fix rebuilds the sandbox credential environment from the current authentication state on every resume.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you resume a saved session after a credential variable was added to the authentication environment, for example by switching providers or authentication modes.