OpenCode AI Coding Agent Flaw Lets Malicious Websites Execute Code on Developer Machines
OpenCode versions 1.14.30 through 1.18.21 let a malicious site run code on a developer's machine via the local upgrade API.
Datadog Security Labs disclosed remote code execution in the OpenCode AI coding agent, tracked as GHSA-632h-h47v-g4x4, affecting versions 1.14.30 through 1.18.21 installed with npm, pnpm, or Bun. The unauthenticated local service parses every request body as JSON, so a malicious webpage can drive /global/upgrade to an attacker tarball whose preinstall script runs on the developer machine. Anomaly fixed this in OpenCode 1.18.22 by requiring a semantic version and rejecting text/plain bodies. No CVE was issued; Datadog said 82 vulnerable releases had more than 647,000 downloads between September 17 and 23, 2026, and did not report observed exploitation.