anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 18:25:32 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

Security Issue - Autoloading Repository Plugins #4340

New Issue
Open
opened 2026-02-16 17:43:30 -05:00 by yindo · 3 comments
yindo commented 2026-02-16 17:43:30 -05:00
Owner
Copy Link
Copy Source

Originally created by @xpcmdshell on GitHub (Jan 6, 2026).

Originally assigned to: @thdxr on GitHub.

Description

opencode-autoplugin-rce

OpenCode automatically loads and runs plugins from the .opencode directory at the project root at startup, without user confirmation. A user who clones a boobytrapped repository to inspect or work on and runs the opencode command immediately gets compromised.

Generally, dev tools should avoid automatically executing scripts from folders that are potentially untrusted. VSCode and other tools like it tend to tackle this with a Trusted/Untrusted mode (where the dangerous features are only enabled once you mark that the repository is Trusted explicitly, and you're asked the first time you interact with it).

A user should be made aware that the repository they are operating in contains bundled plugins which will execute, and be presented a permission dialog illustrating which plugins are included (and an option to approve/deny load before it happens).

Plugins

N/A

OpenCode version

1.1.4

Steps to reproduce

git clone https://github.com/xpcmdshell/opencode-autoplugin-rce
cd opencode-autoplugin-rce
opencode

(see linked repo)

Screenshot and/or share link

No response

Operating System

No response

Terminal

No response

Originally created by @xpcmdshell on GitHub (Jan 6, 2026). Originally assigned to: @thdxr on GitHub. ### Description [opencode-autoplugin-rce](https://github.com/xpcmdshell/opencode-autoplugin-rce) OpenCode automatically loads and runs plugins from the `.opencode` directory at the project root at startup, without user confirmation. A user who clones a boobytrapped repository to inspect or work on and runs the `opencode` command immediately gets compromised. Generally, dev tools should avoid automatically executing scripts from folders that are potentially untrusted. VSCode and other tools like it tend to tackle this with a Trusted/Untrusted mode (where the dangerous features are only enabled once you mark that the repository is Trusted explicitly, and you're asked the first time you interact with it). A user should be made aware that the repository they are operating in contains bundled plugins which will execute, and be presented a permission dialog illustrating which plugins are included (and an option to approve/deny load before it happens). ### Plugins N/A ### OpenCode version 1.1.4 ### Steps to reproduce git clone https://github.com/xpcmdshell/opencode-autoplugin-rce cd opencode-autoplugin-rce opencode (see linked repo) ### Screenshot and/or share link _No response_ ### Operating System _No response_ ### Terminal _No response_
yindo added the bug label 2026-02-16 17:43:30 -05:00
yindo commented 2026-02-16 17:43:30 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Jan 6, 2026):

This issue might be a duplicate of existing issues. Please check:

  • #6361: No trusted workspace functionality leads to arbitrary commands execution on startup - Similar security concern about untrusted repositories auto-executing configurations
  • #6355: RCE and file read vulnerability - Related RCE vulnerabilities in OpenCode
  • #6527: Plan mode restrictions bypassed when spawning sub-agents - Related security bypass issue

Feel free to ignore if none of these address your specific case.

@github-actions[bot] commented on GitHub (Jan 6, 2026): This issue might be a duplicate of existing issues. Please check: - #6361: No trusted workspace functionality leads to arbitrary commands execution on startup - Similar security concern about untrusted repositories auto-executing configurations - #6355: RCE and file read vulnerability - Related RCE vulnerabilities in OpenCode - #6527: Plan mode restrictions bypassed when spawning sub-agents - Related security bypass issue Feel free to ignore if none of these address your specific case.
yindo commented 2026-02-16 17:43:30 -05:00
Author
Owner
Copy Link
Copy Source

@CyberShadow commented on GitHub (Feb 13, 2026):

@xpcmdshell If you haven't done so already, would you mind filing this as an advisory so that it gets due process? https://github.com/anomalyco/opencode/security/advisories/new

@CyberShadow commented on GitHub (Feb 13, 2026): @xpcmdshell If you haven't done so already, would you mind filing this as an advisory so that it gets due process? https://github.com/anomalyco/opencode/security/advisories/new
yindo commented 2026-02-16 17:43:30 -05:00
Author
Owner
Copy Link
Copy Source

@xpcmdshell commented on GitHub (Feb 15, 2026):

Sure thing @CyberShadow, I'll look at filing these later tonight.

@xpcmdshell commented on GitHub (Feb 15, 2026): Sure thing @CyberShadow, I'll look at filing these later tonight.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#4340
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?