Repository navigation
RCE and file read vulnerability #6355
Description
Description
Vulnerability Summary
The OpenCode codebase has critical security vulnerabilities:
- No CORS validation - /packages/opencode/src/server/server.ts:135 uses .use(cors()) with no origin restrictions
- No authentication - Any request works without tokens/credentials
- Arbitrary shell execution and file read - POST /session/:id/shell executes any command GET /file/content?path=/etc/passwd reads file by path
Attack Vector
Any website can:
- Scan localhost ports to find the OpenCode server
- List existing sessions via GET /session
- Create a new session via POST /session
- Execute arbitrary shell commands via POST /session/:id/shell
- Read any file via GET /file/content?path=/etc/passwd
OpenCode version
1.0.207
Steps to reproduce
- start opencode server (or just open opencode in any dir)
- go to https://mishkun.github.io/opencode-rce-poc/ and follow instructions
- enjoy being pwned
Screenshot and/or share link
No response
Operating System
macos
Terminal
iTerm2
Reacted by Henri Cook, Francisco Morales, Alexandro Sanchez Bach, Abhishek Chanda, Connor Adams, Alex Errant, opticaldrive, Zakhar Zibarov, moscovium-mc, screwdrivershark and 2 more
Reacted by Alexandro Sanchez Bach and opticaldrive
Activity
github-actions commentedon Dec 29, 2025
This issue might be a duplicate of existing issues. Please check:
opencode serverapi #5256: [FEATURE]: Adding Authentication toopencode serverapi - directly addresses the authentication vulnerability you've identifiedFeel free to ignore if none of these address your specific case.
Mishkun commentedon Dec 30, 2025
Chrome and chromium require "local network access" permission
latest firefox (146.0.1) doesn't require anything, exploit works without permission
safari and brave browsers block port scanning
rekram1-node commentedon Dec 30, 2025
updating cors policy and releasing that:
7d2d87f
CyberShadow commentedon Jan 8, 2026
Previously reported here: GHSA-vxw4-wv6m-9hhh
@rekram1-node Now that this has been independently reported and fixed, could you please publish the advisory
CyberShadow commentedon Jan 8, 2026
@rekram1-node Why does
opencode.aineed arbitrary command execution powers to all OpenCode users' machines?CyberShadow commentedon Jan 9, 2026
Hi @rekram1-node, FYI - since the issue is now public and I haven't been able to reach anyone from the team regrading the above, I plan to publish a full disclosure of this and remaining problems at https://cy.md/opencode-rce/ in 48 hours (2026-01-11).
thdxr commentedon Jan 9, 2026
hey sorry this got dropped over the holidays
do you mind sending me disclosure to [email protected]
the reason for the opencode.ai exception was for people using the webapp at app.opencode.ai
we've made a change recently not to start the server by default, it's opted into
CyberShadow commentedon Jan 9, 2026
Understandable, but I should note that I first tried reaching out in November. The address mentioned here might not be monitored.
This is great, thank you!
Sent!
CyberShadow commentedon Jan 11, 2026
Posted.
ta-dd commentedon Jan 12, 2026
Thanks to both for finding the vulnerability, as well as the proof-of-concept and the very well written disclosure. Jarring to see such a poor response from the Opencode team, please monitor that email address.
thdxr commentedon Jan 12, 2026
we've done a poor job handling these security reports, usage has grown rapidly and we're overwhelmed with issues
we're meeting with some people this week to advise us on how to handle this better, get a bug bounty program funded and have some audits done
github-actions commentedon Apr 10, 2026
To stay organized issues are automatically closed after 90 days of no activity. If the issue is still relevant please open a new one.
monokrome commentedon Apr 19, 2026
This seems a bit too important to be auto-closed...