anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 10:15:31 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

Security: Arbitrary code execution via Function constructor in debug agent #8267

New Issue
Open
opened 2026-02-16 18:09:33 -05:00 by yindo · 1 comment
yindo commented 2026-02-16 18:09:33 -05:00
Owner
Copy Link
Copy Source

Originally created by @riftzen-bit on GitHub (Feb 1, 2026).

Originally assigned to: @thdxr on GitHub.

Summary

While reviewing the codebase, I found a security vulnerability in the debug agent command that allows arbitrary JavaScript code execution.

Location

packages/opencode/src/cli/cmd/debug/agent.ts:99

Issue

The parseParams function attempts to parse user input as JSON first, but if that fails, it falls back to using the Function constructor to evaluate the input as JavaScript:

const parsed = iife(() => {
  try {
    return JSON.parse(trimmed)
  } catch (jsonError) {
    try {
      return new Function(`return (${trimmed})`)()  // <-- Arbitrary code execution
    } catch (evalError) {
      throw new Error(...)
    }
  }
})

This allows an attacker to execute arbitrary JavaScript code with the full privileges of the opencode process by passing malicious input via the --params flag.

Exploitation Example

opencode agent build --params "process.exit(1); return {}"

Impact

  • Severity: High (requires local CLI access)
  • Impact: Code execution with opencode process privileges

Suggested Fix

Remove the Function constructor fallback entirely and only accept valid JSON input:

const parsed = iife(() => {
  try {
    return JSON.parse(trimmed)
  } catch (jsonError) {
    throw new Error(`Failed to parse --params. Must be valid JSON. Error: ${jsonError}`)
  }
})
Originally created by @riftzen-bit on GitHub (Feb 1, 2026). Originally assigned to: @thdxr on GitHub. ## Summary While reviewing the codebase, I found a security vulnerability in the debug agent command that allows arbitrary JavaScript code execution. ## Location `packages/opencode/src/cli/cmd/debug/agent.ts:99` ## Issue The `parseParams` function attempts to parse user input as JSON first, but if that fails, it falls back to using the `Function` constructor to evaluate the input as JavaScript: ```typescript const parsed = iife(() => { try { return JSON.parse(trimmed) } catch (jsonError) { try { return new Function(`return (${trimmed})`)() // <-- Arbitrary code execution } catch (evalError) { throw new Error(...) } } }) ``` This allows an attacker to execute arbitrary JavaScript code with the full privileges of the opencode process by passing malicious input via the `--params` flag. ## Exploitation Example ```bash opencode agent build --params "process.exit(1); return {}" ``` ## Impact - **Severity**: High (requires local CLI access) - **Impact**: Code execution with opencode process privileges ## Suggested Fix Remove the `Function` constructor fallback entirely and only accept valid JSON input: ```typescript const parsed = iife(() => { try { return JSON.parse(trimmed) } catch (jsonError) { throw new Error(`Failed to parse --params. Must be valid JSON. Error: ${jsonError}`) } }) ```
yindo commented 2026-02-16 18:09:33 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Feb 1, 2026):

This issue might be a duplicate of existing issues. Please check:

  • #6355: RCE and file read vulnerability (different vulnerability but related arbitrary code execution issue)
  • #6361: No trusted workspace functionality leads to arbitrary commands execution on startup (related arbitrary command execution issue)

Feel free to ignore if these don't address your specific case.

@github-actions[bot] commented on GitHub (Feb 1, 2026): This issue might be a duplicate of existing issues. Please check: - #6355: RCE and file read vulnerability (different vulnerability but related arbitrary code execution issue) - #6361: No trusted workspace functionality leads to arbitrary commands execution on startup (related arbitrary command execution issue) Feel free to ignore if these don't address your specific case.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#8267
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?