Discovering and exploiting a remote code execution vulnerability in OpenCode (GHSA-632h-h47v-g4x4)
Datadog demonstrates remote code execution in OpenCode AI coding agent via content-type confusion in the /global/upgrade endpoint, fixed in 1.18.22.
Datadog Security Labs discloses GHSA-632h-h47v-g4x4, a remote code execution flaw in OpenCode, an open-source AI coding agent with over 200,000 GitHub stars and 16 million monthly users. A content-type confusion in the /global/upgrade endpoint lets a malicious webpage send a cross-origin text/plain POST to the unauthenticated local server on 127.0.0.1:4096, supplying an attacker-controlled npm tarball whose preinstall script executes arbitrary code. OpenCode 1.18.22 fixes the vulnerability; users should check their install method and version.
- GHSA-632h-h47v-g4x4 enables RCE in OpenCode versions before 1.18.22
- Drive-by webpage abuses content-type confusion to reach localhost upgrade endpoint
- Malicious npm tarball with preinstall script achieves code execution
- Web UI runs unauthenticated on 127.0.0.1:4096 by default
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 165.227.82.252 | ent-Type : text/plain Host : 127.0.0.1:4096 Origin : http://165.227.82.252:4444 Pragma : no-cache Referer : http://165.227.82.252:4444 |
From the original article
10 min read at securitylabs.datadoghq.com
Datadog Security Labs discovered GHSA-632h-h47v-g4x4, a vulnerability in OpenCode's upgrade endpoint that, under certain conditions, allowed malicious webpages to execute code on developers' machines.
By @datadoghq · securitylabs.datadoghq.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.