AIKIDO-2026-934633

@ai-sdk/harness is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Exposure of Sensitive Information to an Unauthorized ActorGHSA-4mqq-99j3-3hmv Published 2 days ago

High Risk

This Affects:

@ai-sdk/harness

1.0.0 - 1.0.132

Fixed in 1.0.133

Are you affected? Scan for Free

TL;DR

AI SDK Harness adapters pass credentials into a sandbox by replacing real values with non-secret placeholders outside the sandbox boundary. When a saved session is resumed, the adapter reuses the credential placeholder map stored with that session instead of rebuilding it from the current authentication environment. A credential variable added after the session was created is then passed into the sandbox as its real value, and code or agent activity inside the sandbox can read and exfiltrate it without escaping the sandbox. The fix rebuilds the sandbox credential environment from the current authentication state on every resume.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you resume a saved session after a credential variable was added to the authentication environment, for example by switching providers or authentication modes.