OpenCode < 1.0.216 - Unauthenticated Remote Code Execution

OpenCode versions prior to 1.0.216 contain an unauthenticated remote code execution vulnerability. The application exposes session and shell execution endpoints without proper authentication, allowing remote attackers to create sessions and execute arbitrary shell commands on the underlying serve...

CVE-2026-88624

The openCode software version v1.18.26 contains a vulnerability in the Worktree.remove component due to missing path validation . An attacker can provide a crafted payload to trigger arbitrary recursive directory deletion . No specific remediation details or exploit links are provided in the docu...

EUVD-2026-84856

Missing path validation in the Worktree.remove component of openCode v1.18.26 allows attackers to execute arbitrary recursive directory deletion via a crafted payload...

opencode

Открытый AI-агент для программирования. English | 简体中文 | 繁體中文 | 한국어 | Deutsch | Español | Français | Italiano | Dansk | 日本語 | | | | | | | | | | | |...

CVE-2026-22812

🔐 CVE-2026-22812 — Неаутентифицированный HTTP-сервер OpenCode → удалённое выполнение кода RCE Уведомление безопасности, технический анализ, рекомендации по обнаружению и меры по смягчению последствий для CVE-2026-22812 📌 Обзор CVE-2026-22812 — это уязвимость высокой степени серьёзности, приводяща...

CVE-2026-22812

CVE-2026-22812 CVE-2026-22812 — шаблон Nuclei для неаутентифицированного RCE в OpenCode для сканирования. запрос burp suite root@kitploit: POST /session HTTP/1.1 Host: target.com User-Agent: Mozilla/5.0 X11; Linux x8664 Content-Type: application/json Content-Length: 2 root@kitploit: POST...

opencode-secure

Открытый ИИ-агент для написания кода. Установка root@kitploit: YOLO curl -fsSL https://opencode.ai/install | bash Менеджеры пакетов npm i -g opencode-ai@latest или bun/pnpm/yarn scoop install opencode Windows choco install opencode Windows brew install anomalyco/tap/opencode macOS и Linux...

CVE-2026-22812-OpenCode-RCE-exp

CVE-2026-22812-OpenCode-RCE-exp Способ использования: java -jar xxx.jar Рекомендуемая среда: jdk8...

CVE-2026-22812-exploit

Инструмент эксплуатации CVE-2026-22812 Полнофункциональный набор инструментов для эксплуатации CVE-2026-22812 — неаутентифицированное удалённое выполнение кода в OpenCode 🎯 Обзор Инструмент эксплуатации CVE-2026-22812 — это комплексная платформа для эксплуатации уязвимости неаутентифицированного...

CVE-2026-22812

CVE-2026-22812 Обзор Инструмент эксплуатации на Python для уязвимости удалённого выполнения кода RCE в OpenCode, затрагивающей версии v1.0.216. Инструмент предоставляет несколько векторов атаки, включая выполнение команд, чтение/запись файлов, загрузку/скачивание файлов и интерактивную оболочку...

CVE-2026-22812-POC

OpenCode CVE-2026-22812 Exploiter Простые Python-инструменты для проверки и эксплуатации уязвимости OpenCode CVE-2026-22812. Установка root@kitploit: git clone https://github.com/CayberMods/CVE-2026-22812-POC.git cd CVE-2026-22812-POC pip install requests urllib3 argparse concurrent-log-handler...

CVE-2026-88899

CVE-2026-88899 - Knowns 0.30.0 인증되지 않은 헤더 주입으로 AI 에이전트가 호스트 파일시스템에 무제한 접근 가능 개요 Knowns의 내장 OpenCode AI 에이전트 데몬용 리버스 프록시internal/server/server.go와 관련하여 부적절한 권한 부여 및 헤더 스푸핑 취약점이 보고되었습니다. 보고서에 따르면, 로컬 OpenCode 데몬으로 HTTP 요청을 프록시할 때 프록시가 x-opencode-directory 요청 헤더와 ?directory 쿼리 파라미터를 무조건 덮어쓰지 못했습니다. ...

CVE-2026-88899 knowns before 0.31.0 External Control of Agent Working Directory via x-opencode-directory Header

knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode proxy endpoint. Remote attackers can supply arbitrary directory paths to execute file operations outside the project root on the host system...

CVE-2026-88899 knowns before 0.31.0 External Control of Agent Working Directory via x-opencode-directory Header

knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode proxy endpoint. Remote attackers can supply arbitrary directory paths to execute file operations outside the project root on the host system...

EUVD-2026-75579

knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode proxy endpoint. Remote attackers can supply arbitrary directory paths to execute file operations outside the project root on the host system...

CVE-2026-88899 knowns before 0.31.0 External Control of Agent Working Directory via x-opencode-directory Header

knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode proxy endpoint. Remote attackers can supply arbitrary directory paths to execute file operations outside the project root on the host system...

CVE-2026-88899

knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode proxy endpoint. This allows remote, unauthenticated attackers to supply arbitrary directory paths, enabling file operations outside the project root on the host system. The vulnera...

PT-2026-89477

knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode proxy endpoint. Remote attackers can supply arbitrary directory paths to execute file operations outside the project root on the host system...

opencode-1.18.26-1.1 on GA media (moderate)

opencode-1.18.26-1.1 on GA media Announcement ID: openSUSE-SU-2026:11673-1 Rating: moderate Cross-References: CVE-2026-23736 CVE-2026-23737 CVE-2026-59940 Affected Products: openSUSE Tumbleweed An update that solves 3 vulnerabilities can now be installed. Description: These are all security issue...

OpenCode Unauthenticated Remote Code Execution

OpenCode versions prior to 1.0.216 contain an unauthenticated remote code execution vulnerability that can allow a remote attacker to obtain a session identifier and execute arbitrary commands through the session shell endpoint. This proof of concept retrieves an available session and demonstrate...