OpenCode AI coding agent hit by critical unauthenticated RCE vulnerability (opens in new tab)

(github.com)

3 pointsAlexAltea2mo ago2 comments

2 comments

rvz2mo ago

Probably nothing.

Probably nothing based on what? I have reproduced the finding locally...

Any website can trivially run arbitrary code as the current user if OpenCode is installed; that's CVSS ~10.

j / k navigate · click thread line to collapse

(github.com)

3 pointsAlexAltea2mo ago2 comments

rvz2mo ago

Probably nothing.

Probably nothing based on what? I have reproduced the finding locally...

Any website can trivially run arbitrary code as the current user if OpenCode is installed; that's CVSS ~10.

j / k navigate · click thread line to collapse