ai-sdk has 1 advisory. Version not read yet.
npm ↗Versions
Red: affected by at least one advisory. White: safe. The dot is the version in your lockfile.
1.x
safe 1.0.77
AffectedSafe
Details
- You run
- not in lockfile
- Safe
- 1.0.77
- Advisories
- 1 in 120 days
Used by
Stacks that pull this package.
Not part of a tracked stack.
Alerts(1)
Conditions not read yet
Source summary
Impact The @ai-sdk/harness-acp host-tool relay did not verify that relay requests matched model-generated tool calls. Untrusted sandbox code that obtained the relay credential could invoke registered host tools during an active prompt turn. Impact depends on the tools exposed by the application. Tools requiring explicit user approval remain protected. Patches Upgrade to @ai-sdk/harness-acp 1.0.77 or later. References - https://github.com/vercel/ai/pull/21826
- Affected
- ai-sdk >=1.0.0
- Fixed in
- 1.0.77
- ID
- GHSA-g3x3-7q3h-gmhj