anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 10:15:31 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

Security Issue - Lifecycle Script Execution via .opencode/package.json #4342

New Issue
Open
opened 2026-02-16 17:43:30 -05:00 by yindo · 3 comments
yindo commented 2026-02-16 17:43:30 -05:00
Owner
Copy Link
Copy Source

Originally created by @xpcmdshell on GitHub (Jan 7, 2026).

Originally assigned to: @thdxr on GitHub.

Description

Description

opencode-lifecycle-rce

OpenCode automatically runs bun install in any .opencode directory found in the current project at startup. This executes preinstall/postinstall scripts defined in .opencode/package.json without user confirmation. A user who clones a boobytrapped repository to inspect or work on and runs the opencode command immediately gets compromised.

The root cause is in packages/opencode/src/config/config.ts - the installDependencies() function runs bun install in each .opencode directory:

await BunProc.run(["install"], { cwd: dir }).catch(() => {})

If an attacker includes a .opencode/package.json with lifecycle scripts, they execute automatically:

{"scripts":{"preinstall":"id > /tmp/pwned.txt"}}

This is similar to #7163 (auto-loading plugins) but exploits a different code path - the dependency installation rather than plugin loading.

Plugins

N/A

OpenCode version

1.1.4

Steps to reproduce

git clone https://github.com/xpcmdshell/opencode-lifecycle-rce
cd opencode-lifecycle-rce
opencode
# exit opencode
cat /tmp/pwned.txt

(see linked repo)

Screenshot and/or share link

No response

Operating System

No response

Terminal

No response

Plugins

No response

OpenCode version

No response

Steps to reproduce

No response

Screenshot and/or share link

No response

Operating System

No response

Terminal

No response

Originally created by @xpcmdshell on GitHub (Jan 7, 2026). Originally assigned to: @thdxr on GitHub. ### Description ### Description [opencode-lifecycle-rce](https://github.com/xpcmdshell/opencode-lifecycle-rce) OpenCode automatically runs `bun install` in any `.opencode` directory found in the current project at startup. This executes `preinstall`/`postinstall` scripts defined in `.opencode/package.json` without user confirmation. A user who clones a boobytrapped repository to inspect or work on and runs the `opencode` command immediately gets compromised. The root cause is in `packages/opencode/src/config/config.ts` - the `installDependencies()` function runs `bun install` in each `.opencode` directory: ```typescript await BunProc.run(["install"], { cwd: dir }).catch(() => {}) ``` If an attacker includes a `.opencode/package.json` with lifecycle scripts, they execute automatically: ```json {"scripts":{"preinstall":"id > /tmp/pwned.txt"}} ``` This is similar to #7163 (auto-loading plugins) but exploits a different code path - the dependency installation rather than plugin loading. ### Plugins N/A ### OpenCode version 1.1.4 ### Steps to reproduce ``` git clone https://github.com/xpcmdshell/opencode-lifecycle-rce cd opencode-lifecycle-rce opencode # exit opencode cat /tmp/pwned.txt ``` (see linked repo) ### Screenshot and/or share link _No response_ ### Operating System _No response_ ### Terminal _No response_ ### Plugins _No response_ ### OpenCode version _No response_ ### Steps to reproduce _No response_ ### Screenshot and/or share link _No response_ ### Operating System _No response_ ### Terminal _No response_
yindo added the bug label 2026-02-16 17:43:30 -05:00
yindo commented 2026-02-16 17:43:31 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Jan 7, 2026):

This issue might be a duplicate of existing issues. Please check:

  • #7163: Security Issue - Autoloading Repository Plugins (similar RCE vector via auto-execution of untrusted code from cloned repositories)
  • #6361: No trusted workspace functionality leads to arbitrary commands execution on startup (addresses the broader need for trusted workspace verification before executing project configs)
  • #6355: RCE and file read vulnerability (related critical security vulnerabilities)

Feel free to ignore if this specific lifecycle script execution path needs separate handling from the plugin loading mechanism.

@github-actions[bot] commented on GitHub (Jan 7, 2026): This issue might be a duplicate of existing issues. Please check: - #7163: Security Issue - Autoloading Repository Plugins (similar RCE vector via auto-execution of untrusted code from cloned repositories) - #6361: No trusted workspace functionality leads to arbitrary commands execution on startup (addresses the broader need for trusted workspace verification before executing project configs) - #6355: RCE and file read vulnerability (related critical security vulnerabilities) Feel free to ignore if this specific lifecycle script execution path needs separate handling from the plugin loading mechanism.
yindo commented 2026-02-16 17:43:31 -05:00
Author
Owner
Copy Link
Copy Source

@CyberShadow commented on GitHub (Feb 13, 2026):

@xpcmdshell If you haven't done so already, would you mind filing this as an advisory so that it gets due process? https://github.com/anomalyco/opencode/security/advisories/new

@CyberShadow commented on GitHub (Feb 13, 2026): @xpcmdshell If you haven't done so already, would you mind filing this as an advisory so that it gets due process? https://github.com/anomalyco/opencode/security/advisories/new
yindo commented 2026-02-16 17:43:31 -05:00
Author
Owner
Copy Link
Copy Source

@xpcmdshell commented on GitHub (Feb 16, 2026):

Submitted each advisory, will await review

@xpcmdshell commented on GitHub (Feb 16, 2026): Submitted each advisory, will await review
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#4342
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?