@mcpjam/inspector (>=2.22.0, <=3.3.1) potentially affected by CVE-2026-64650 via @ai-sdk/harness-codex (1.0.0-canary.9)

@ai-sdk/harness-codex NPM version 1.0.0-canary.9 is affected by a known vulnerability. The following packages have a transitive dependency on @ai-sdk/harness-codex and may be impacted: - @mcpjam/inspector =2.22.0, =3.3.1 Source cves: CVE-2026-64650 Source advisory: SNYK:JS-AISDKHARNESSCODEX-18172...

Incorrect Authorization

Overview @ai-sdk/harness-codex is a HarnessV1 adapter backed by @openai/codex-sdk, which drives the codex CLI. The adapter ships a bridge process that runs inside a sandbox and talks to the host over a WebSocket on a sandbox-proxied l Affected versions of this package are vulnerable to Incorrect...