anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 10:15:31 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

RCE and file read vulnerability #3963

New Issue
Open
opened 2026-02-16 17:42:06 -05:00 by yindo · 11 comments
yindo commented 2026-02-16 17:42:06 -05:00
Owner
Copy Link
Copy Source

Originally created by @Mishkun on GitHub (Dec 29, 2025).

Originally assigned to: @thdxr on GitHub.

Description

Vulnerability Summary

The OpenCode codebase has critical security vulnerabilities:

  1. No CORS validation - /packages/opencode/src/server/server.ts:135 uses .use(cors()) with no origin restrictions
  2. No authentication - Any request works without tokens/credentials
  3. Arbitrary shell execution and file read - POST /session/:id/shell executes any command GET /file/content?path=/etc/passwd reads file by path

Attack Vector

Any website can:

  1. Scan localhost ports to find the OpenCode server
  2. List existing sessions via GET /session
  3. Create a new session via POST /session
  4. Execute arbitrary shell commands via POST /session/:id/shell
  5. Read any file via GET /file/content?path=/etc/passwd

OpenCode version

1.0.207

Steps to reproduce

  1. start opencode server (or just open opencode in any dir)
  2. go to https://mishkun.github.io/opencode-rce-poc/ and follow instructions
  3. enjoy being pwned

Screenshot and/or share link

No response

Operating System

macos

Terminal

iTerm2

Originally created by @Mishkun on GitHub (Dec 29, 2025). Originally assigned to: @thdxr on GitHub. ### Description ## Vulnerability Summary The OpenCode codebase has critical security vulnerabilities: 1. No CORS validation - /packages/opencode/src/server/server.ts:135 uses .use(cors()) with no origin restrictions 2. No authentication - Any request works without tokens/credentials 3. Arbitrary shell execution and file read - POST /session/:id/shell executes any command GET /file/content?path=/etc/passwd reads file by path ## Attack Vector Any website can: 1. Scan localhost ports to find the OpenCode server 2. List existing sessions via GET /session 3. Create a new session via POST /session 4. Execute arbitrary shell commands via POST /session/:id/shell 5. Read any file via GET /file/content?path=/etc/passwd ### OpenCode version 1.0.207 ### Steps to reproduce 1. start opencode server (or just open opencode in any dir) 2. go to https://mishkun.github.io/opencode-rce-poc/ and follow instructions 3. enjoy being pwned ### Screenshot and/or share link _No response_ ### Operating System macos ### Terminal iTerm2
yindo added the bug label 2026-02-16 17:42:06 -05:00
yindo commented 2026-02-16 17:42:06 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Dec 29, 2025):

This issue might be a duplicate of existing issues. Please check:

  • #5256: [FEATURE]: Adding Authentication to opencode server api - directly addresses the authentication vulnerability you've identified
  • #5076: OpenCode should have better/safer defaults to be more security minded - discusses related security concerns about default configurations

Feel free to ignore if none of these address your specific case.

@github-actions[bot] commented on GitHub (Dec 29, 2025): This issue might be a duplicate of existing issues. Please check: - #5256: [FEATURE]: Adding Authentication to `opencode server` api - directly addresses the authentication vulnerability you've identified - #5076: OpenCode should have better/safer defaults to be more security minded - discusses related security concerns about default configurations Feel free to ignore if none of these address your specific case.
yindo commented 2026-02-16 17:42:07 -05:00
Author
Owner
Copy Link
Copy Source

@Mishkun commented on GitHub (Dec 30, 2025):

Chrome and chromium require "local network access" permission
latest firefox (146.0.1) doesn't require anything, exploit works without permission
safari and brave browsers block port scanning

@Mishkun commented on GitHub (Dec 30, 2025): Chrome and chromium require "local network access" permission latest firefox (146.0.1) doesn't require anything, exploit works without permission safari and brave browsers block port scanning
yindo commented 2026-02-16 17:42:07 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Dec 30, 2025):

updating cors policy and releasing that:
https://github.com/sst/opencode/commit/7d2d87fa2c44e32314015980bb4e59a9386e858c

@rekram1-node commented on GitHub (Dec 30, 2025): updating cors policy and releasing that: https://github.com/sst/opencode/commit/7d2d87fa2c44e32314015980bb4e59a9386e858c
yindo commented 2026-02-16 17:42:07 -05:00
Author
Owner
Copy Link
Copy Source

@CyberShadow commented on GitHub (Jan 8, 2026):

Previously reported here: https://github.com/anomalyco/opencode/security/advisories/GHSA-vxw4-wv6m-9hhh

@rekram1-node Now that this has been independently reported and fixed, could you please publish the advisory

@CyberShadow commented on GitHub (Jan 8, 2026): Previously reported here: https://github.com/anomalyco/opencode/security/advisories/GHSA-vxw4-wv6m-9hhh @rekram1-node Now that this has been independently reported and fixed, could you please publish the advisory
yindo commented 2026-02-16 17:42:07 -05:00
Author
Owner
Copy Link
Copy Source

@CyberShadow commented on GitHub (Jan 8, 2026):

@rekram1-node Why does opencode.ai need arbitrary command execution powers to all OpenCode users' machines?

@CyberShadow commented on GitHub (Jan 8, 2026): @rekram1-node Why does `opencode.ai` need arbitrary command execution powers to all OpenCode users' machines?
yindo commented 2026-02-16 17:42:07 -05:00
Author
Owner
Copy Link
Copy Source

@CyberShadow commented on GitHub (Jan 9, 2026):

Hi @rekram1-node, FYI - since the issue is now public and I haven't been able to reach anyone from the team regrading the above, I plan to publish a full disclosure of this and remaining problems at https://cy.md/opencode-rce/ in 48 hours (2026-01-11).

@CyberShadow commented on GitHub (Jan 9, 2026): Hi @rekram1-node, FYI - since the issue is now public and I haven't been able to reach anyone from the team regrading the above, I plan to publish a full disclosure of this and remaining problems at https://cy.md/opencode-rce/ in 48 hours (2026-01-11).
yindo commented 2026-02-16 17:42:07 -05:00
Author
Owner
Copy Link
Copy Source

@thdxr commented on GitHub (Jan 9, 2026):

hey sorry this got dropped over the holidays

do you mind sending me disclosure to dax@anoma.ly

the reason for the opencode.ai exception was for people using the webapp at app.opencode.ai

we've made a change recently not to start the server by default, it's opted into

@thdxr commented on GitHub (Jan 9, 2026): hey sorry this got dropped over the holidays do you mind sending me disclosure to dax@anoma.ly the reason for the opencode.ai exception was for people using the webapp at app.opencode.ai we've made a change recently not to start the server by default, it's opted into
yindo commented 2026-02-16 17:42:07 -05:00
Author
Owner
Copy Link
Copy Source

@CyberShadow commented on GitHub (Jan 9, 2026):

hey sorry this got dropped over the holidays

Understandable, but I should note that I first tried reaching out in November. The address mentioned here might not be monitored.

we've made a change recently not to start the server by default, it's opted into

This is great, thank you!

do you mind sending me disclosure to dax@anoma.ly

Sent!

@CyberShadow commented on GitHub (Jan 9, 2026): > hey sorry this got dropped over the holidays Understandable, but I should note that I first tried reaching out in November. The address mentioned [here](https://github.com/anomalyco/opencode-sdk-js/blob/main/SECURITY.md) might not be monitored. > we've made a change recently not to start the server by default, it's opted into This is great, thank you! > do you mind sending me disclosure to [dax@anoma.ly](mailto:dax@anoma.ly) Sent!
yindo commented 2026-02-16 17:42:07 -05:00
Author
Owner
Copy Link
Copy Source

@CyberShadow commented on GitHub (Jan 11, 2026):

I plan to publish a full disclosure of this and remaining problems at https://cy.md/opencode-rce/ in 48 hours (2026-01-11).

Posted.

@CyberShadow commented on GitHub (Jan 11, 2026): > I plan to publish a full disclosure of this and remaining problems at https://cy.md/opencode-rce/ in 48 hours (2026-01-11). Posted.
yindo commented 2026-02-16 17:42:07 -05:00
Author
Owner
Copy Link
Copy Source

@ta-dd commented on GitHub (Jan 11, 2026):

Thanks to both for finding the vulnerability, as well as the proof-of-concept and the very well written disclosure. Jarring to see such a poor response from the Opencode team, please monitor that email address.

@ta-dd commented on GitHub (Jan 11, 2026): Thanks to both for finding the vulnerability, as well as the proof-of-concept and the very well written disclosure. Jarring to see such a poor response from the Opencode team, please monitor that email address.
yindo commented 2026-02-16 17:42:07 -05:00
Author
Owner
Copy Link
Copy Source

@thdxr commented on GitHub (Jan 12, 2026):

we've done a poor job handling these security reports, usage has grown rapidly and we're overwhelmed with issues

we're meeting with some people this week to advise us on how to handle this better, get a bug bounty program funded and have some audits done

@thdxr commented on GitHub (Jan 12, 2026): we've done a poor job handling these security reports, usage has grown rapidly and we're overwhelmed with issues we're meeting with some people this week to advise us on how to handle this better, get a bug bounty program funded and have some audits done
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#3963
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?