CVE-2026-88624

The openCode software version v1.18.26 contains a vulnerability in the Worktree.remove component due to missing path validation . An attacker can provide a crafted payload to trigger arbitrary recursive directory deletion . No specific remediation details or exploit links are provided in the docu...

EUVD-2026-84856

Missing path validation in the Worktree.remove component of openCode v1.18.26 allows attackers to execute arbitrary recursive directory deletion via a crafted payload...