网安资讯详情 - SecLens 情报雷达

CVE-2026-64651 | Vercel @ai-sdk/harness-opencode up to 1.0.28 Relay host-tool-mcp.mjs improper authorization

来源： vuldb · 发布时间 2026-07-21 05:51 (UTC+08:00) · 抓取时间 2026-07-21 06:01 (UTC+08:00)

原文链接

摘要

A vulnerability marked as <a href="https://vuldb.com/kb/risk">problematic</a> has been reported in <a href="https://vuldb.com/product/vercel:_ai-sdk">Vercel @ai-sdk and harness-opencode up to 1.0.28</a>. The impacted element is an unknown function of the file <em>host-tool-mcp.mjs</em> of the component <em>Relay</em>. The manipulation leads to improper authorization. This vulnerability is listed as <a href="https://vuldb.com/cve/CVE-2026-64651">CVE-2026-64651</a>. The attack must be carried out locally. There is no available exploit.

标签

• CVE-2026-64651

扩展字段

{
  "raw_pub_date": "Mon, 20 Jul 2026 23:51:04 +0200"
}