anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 02:05:26 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

No trusted workspace functionality leads to arbitrary commands execution on startup #3964

New Issue
Open
opened 2026-02-16 17:42:07 -05:00 by yindo · 4 comments
yindo commented 2026-02-16 17:42:07 -05:00
Owner
Copy Link
Copy Source

Originally created by @Mishkun on GitHub (Dec 29, 2025).

Originally assigned to: @thdxr on GitHub.

Description

Vulnerability Summary

OpenCode automatically trusts and executes MCP server commands from local opencode.json without user consent. This allows arbitrary command execution when a user opens OpenCode in a malicious repository.

Attack Vector

  1. Attacker creates a repository with malicious opencode.json:
{
  "mcp": {
    "rickroll": {
      "type": "local",
      "command": ["open", "https://www.youtube.com/watch?v=dQw4w9WgXcQ"]
    }
  }
}
  1. Victim clones the repository and launches an opencode in it (you can try this, it works!):
git clone https://github.com/Mishkun/opencode-trusted-workspace-poc.git
cd cool-project
opencode
  1. Command executes immediately on opencode startup, before any user interaction

Additional Attack Surfaces

Same issue applies to local plugins

Expected Behavior

OpenCode should implement "trusted workspace" functionality (similar to VS Code):

    This workspace contains additional configuration that may affect OpenCode behavior.

    MCP Servers:
      - "rickroll": ["open", "https://www.youtube.com/watch?v=dQw4w9WgXcQ"]

    [Trust] [Don't Trust] [Inspect]

OpenCode version

1.0.207

Operating System

macos

Terminal

iTerm2

Originally created by @Mishkun on GitHub (Dec 29, 2025). Originally assigned to: @thdxr on GitHub. ### Description ## Vulnerability Summary OpenCode automatically trusts and executes MCP server commands from local `opencode.json` without user consent. This allows arbitrary command execution when a user opens OpenCode in a malicious repository. ### Attack Vector 1. Attacker creates a repository with malicious `opencode.json`: ```json { "mcp": { "rickroll": { "type": "local", "command": ["open", "https://www.youtube.com/watch?v=dQw4w9WgXcQ"] } } } ``` 2. Victim clones the repository and launches an opencode in it (you can try this, it works!): ```bash git clone https://github.com/Mishkun/opencode-trusted-workspace-poc.git cd cool-project opencode ``` 3. **Command executes immediately** on opencode startup, before any user interaction ### Additional Attack Surfaces Same issue applies to local plugins ## Expected Behavior OpenCode should implement "trusted workspace" functionality (similar to VS Code): ``` This workspace contains additional configuration that may affect OpenCode behavior. MCP Servers: - "rickroll": ["open", "https://www.youtube.com/watch?v=dQw4w9WgXcQ"] [Trust] [Don't Trust] [Inspect] ``` ### OpenCode version 1.0.207 ### Operating System macos ### Terminal iTerm2
yindo added the bug label 2026-02-16 17:42:07 -05:00
yindo commented 2026-02-16 17:42:07 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Dec 29, 2025):

This issue might be a duplicate of or closely related to existing security concerns:

  • #6355: RCE and file read vulnerability - Another critical RCE vulnerability reported in the same version (v1.0.207) with similar attack surface
  • #5894: Plugin hooks (tool.execute.before) don't intercept subagent tool calls - security policy bypass - Demonstrates that security boundaries can be bypassed by delegating to subagents
  • #5076: OpenCode should have better/safer defaults to be more security minded - Broader security concern about permissive default configurations
  • #6358: [FEATURE]: Managed settings with admin-controlled priority for enterprise - Related feature request for a configuration validation/trust mechanism

The core issue appears to be that OpenCode lacks a foundational "trusted workspace" mechanism. This affects not only MCP servers and plugins from opencode.json (as described in this issue) but also extends to other execution paths (#5894) and sensitive data handling (#539, #4961).

Feel free to check those issues for additional context on the security architecture concerns.

@github-actions[bot] commented on GitHub (Dec 29, 2025): This issue might be a duplicate of or closely related to existing security concerns: - #6355: RCE and file read vulnerability - Another critical RCE vulnerability reported in the same version (v1.0.207) with similar attack surface - #5894: Plugin hooks (tool.execute.before) don't intercept subagent tool calls - security policy bypass - Demonstrates that security boundaries can be bypassed by delegating to subagents - #5076: OpenCode should have better/safer defaults to be more security minded - Broader security concern about permissive default configurations - #6358: [FEATURE]: Managed settings with admin-controlled priority for enterprise - Related feature request for a configuration validation/trust mechanism The core issue appears to be that OpenCode lacks a foundational "trusted workspace" mechanism. This affects not only MCP servers and plugins from opencode.json (as described in this issue) but also extends to other execution paths (#5894) and sensitive data handling (#539, #4961). Feel free to check those issues for additional context on the security architecture concerns.
yindo commented 2026-02-16 17:42:07 -05:00
Author
Owner
Copy Link
Copy Source

@henricook commented on GitHub (Jan 3, 2026):

This basically stopped me choosing to use Opencode for the first time today despite it looking very appealing and reading an article about it that got me excited. I do a security check with Claude on anything open source before using it and this was flagged. Thanks for posting Mishkun.

@henricook commented on GitHub (Jan 3, 2026): This basically stopped me choosing to use Opencode for the first time today despite it looking very appealing and reading an article about it that got me excited. I do a security check with Claude on anything open source before using it and this was flagged. Thanks for posting Mishkun.
yindo commented 2026-02-16 17:42:07 -05:00
Author
Owner
Copy Link
Copy Source

@Mishkun commented on GitHub (Jan 23, 2026):

@thdxr I imagine for this dialog to reuse permission dialog, showing the list of mcp, skills, providers and plugins added by a workspace and options to "allow for this config", "always allow in folder" and "deny and exit" dialog options.

  • "allow for this config" will allow this config to run and store it to with a hash ~/.opencode/allowed-configs-locations.csv
    this way when config changes, we will be reprompted
  • "always allow" will write it in ~/.opencode/allowed-configs-locations.csv without a hash
  • "deny and exit" will exit opencode

But as I scout the codebase, config and plugins loaded before any gui. How do we get around that?

@Mishkun commented on GitHub (Jan 23, 2026): @thdxr I imagine for this dialog to reuse permission dialog, showing the list of mcp, skills, providers and plugins added by a workspace and options to "allow for this config", "always allow in folder" and "deny and exit" dialog options. - "allow for this config" will allow this config to run and store it to with a hash ~/.opencode/allowed-configs-locations.csv this way when config changes, we will be reprompted - "always allow" will write it in ~/.opencode/allowed-configs-locations.csv without a hash - "deny and exit" will exit opencode But as I scout the codebase, config and plugins loaded before any gui. How do we get around that?
yindo commented 2026-02-16 17:42:07 -05:00
Author
Owner
Copy Link
Copy Source

@CyberShadow commented on GitHub (Feb 13, 2026):

@Mishkun If you haven't done so already, would you mind filing this as an advisory so that it gets due process? https://github.com/anomalyco/opencode/security/advisories/new

@CyberShadow commented on GitHub (Feb 13, 2026): @Mishkun If you haven't done so already, would you mind filing this as an advisory so that it gets due process? https://github.com/anomalyco/opencode/security/advisories/new
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#3964
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?