⌁ CyberSecurityBoardThreat Intel · CVEs · Products
Critical CVEs

CVE-2026-64650: Vercel AI SDK Codex Harness Authorization Bypass

August 6, 2026

The @ai-sdk/harness-codex package through version 1.0.28 allows sandboxed code to invoke host-exposed tools by spoofing the process path. CVSS v4.0 score 6.3. Fixed in version 1.0.29.

Discovered from: AWS, Google, and Vercel Patch Agent Flaws Allowing Tool Execution Without Model Authorization