CVE-2026-64651

The "@ai-sdk/harness-opencode" tool connects HarnessAgent to OpenCode through a sandboxed bridge. Prior to version 1.0.28, the tool relay authorizes requests from any process whose command line contains an allowed helper script path "host-tool-mcp.mjs". This allows untrusted code executing in the...