OpenCode AI coding agent hit by critical unauthenticated RCE vulnerabilitygithub.com/anomalyco 3 pointsAlexAltea8 months ago2 commentsSaveHideCopy link On HNComments−rvz8moProbably nothing.−AlexAlteaOP8moProbably nothing based on what? I have reproduced the finding locally...Any website can trivially run arbitrary code as the current user if OpenCode is installed; that's CVSS ~10.
Comments
Probably nothing.
Probably nothing based on what? I have reproduced the finding locally...
Any website can trivially run arbitrary code as the current user if OpenCode is installed; that's CVSS ~10.