OpenCode AI coding agent hit by critical unauthenticated RCE vulnerability(github.com)

3 pointsby AlexAlteahá 6 meses2 comments

OpenCode AI coding agent hit by critical unauthenticated RCE vulnerability

https://github.com/anomalyco/opencode/issues/6355

2 comments

rvzhá 6 meses

Probably nothing.

Probably nothing based on what? I have reproduced the finding locally...

Any website can trivially run arbitrary code as the current user if OpenCode is installed; that's CVSS ~10.