WS-2026-0073

OpenCode is an open source AI coding agent. In versions 1.14.30 through 1.18.21, the "/global/upgrade" endpoint of the "opencode serve" HTTP server parses a "text/plain" request body as JSON, does not validate the request Origin, and passes an arbitrary package specifier from the "target" field t...