Unauthenticated remote code execution in OpenCode

Post by rando77 » Tue, Jan 13, 2026, 10:51 AM UTC

varenc wrote: post #85

thdxr wrote: post #14

Earlier quoted context omitted.

the email they found was from a different repo and not monitored. this is ultimately our fault for not having a proper SECURITY.md on our main repository the issue that was reported was fixed as soon as we heard about it - going through the process of learning about the CVE process, etc now and setting everything up correctly. we get 100s of issues reported to us daily across various mediums and we're figuring out ho…

Also consider putting a security.txt[0] file on your main domain, like here: https://opencode.ai/.well-known/security.txt I also just want to sympathize with the difficulty of spotting the real reports from the noise. For a time I helped manage a bug bounty program, and 95% of issues were long reports with plausible titles that ended up saying something like "if an attacker can access the user's device, they can acce…

Post by kmarc » Tue, Jan 13, 2026, 11:48 AM UTC

dxuh wrote: post #114

I liked aider initially, but I keep running into problems, as the project seems largely unmaintained. I wanted to install OpenCode yesterday, but this somewhat turns me off. Are there any good model-agnostic alternatives? I am somewhat shocked there is not a lot of good open source CLI LLM code assistants going around.

Post by ollien » Tue, Jan 13, 2026, 12:27 PM UTC

mirashii wrote: post #117

ollien wrote: post #92

Earlier quoted context omitted.

> Neovim’s server defaults to named pipes or domain sockets, which do not have this issue. The documentation states that the TCP option is insecure. Good note on pipes / domain sockets, but it doesn't appear there's a "default", and the example in the docs even uses TCP, despite the warning below it. https://neovim.io/doc/user/api.html#rpc-connecting (EDIT: I guess outside of headless mode it uses a named pipe?) > VS…

> but it doesn't appear there's a "default" From the page you linked: Nvim creates a default RPC socket at startup, given by v:servername. You can follow the links on v:servername to read more about the startup process and figure out what that is, but tl;dr, it's a named pipe unless you override it.

Post by xmcqdpt2 » Tue, Jan 13, 2026, 12:58 PM UTC

_zoltan_ wrote: post #109

kaliszad wrote: post #52

Many people seem to be running OpenCode and similar tools on their laptop with basically no privilege separation, sandboxing, fine-grained permissions settings in the tool itself. This tendency is reflected also by how many plugins are designed, where the default assumption is the tool is running unrestricted on the computer next to some kind of IDE as many authentication callbacks go to some port on localhost and th…

Claude asks you for permissions every time it wants to run something.

Post by lostmsu » Tue, Jan 13, 2026, 1:52 PM UTC

Y_Y wrote: post #21

bopbopbop7 wrote: post #13

Earlier quoted context omitted.

Why not just ask Claude to fix the security issues and make sure they don't happen again?

Talk about kicking someone while they're down...