@ai-sdk/harness-acp has 1 advisory. Version not read yet.
npm ↗Versions
Red: affected by at least one advisory. White: safe. The dot is the version in your lockfile.
Details
- You run
- not in lockfile
- Safe
- 1.0.71
- Advisories
- 1 in 120 days
Used by
Stacks that pull this package.
Not part of a tracked stack.
Alerts(1)
Source summary
Summary A vulnerability in AI SDK Harness credential brokering can expose host credentials to sandboxed code when an existing session is resumed with a newly introduced credential environment variable. Credential brokering normally supplies non-secret placeholders to the sandbox and substitutes real credentials outside the sandbox boundary for approved outbound requests. Affected adapters reuse the credential-placeholder map saved with the previous session without ensuring that it covers the current authentication environment. As a result, newly introduced credentials can be passed into the sa
- Affected
- @ai-sdk/harness-opencode <1.0.135 · @ai-sdk/harness-claude-code <1.0.137 · @ai-sdk/harness-codex <1.0.135 · @ai-sdk/harness-deepagents <1.0.133 · @ai-sdk/harness <1.0.133 · @ai-sdk/harness-acp <1.0.71
- Fixed in
- 1.0.135 · 1.0.137 · 1.0.133 · 1.0.71
- ID
- GHSA-4mqq-99j3-3hmv