Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Unauthenticated remote code execution in OpenCode

cy.md

Post reply on HN
Print view View original

131–140 of 155 posts

Re: Unauthenticated remote code execution in OpenCode

#131

Post by naowal »

BoredPositron wrote: post #112
thdxr wrote: post #14

Earlier quoted context omitted.

the email they found was from a different repo and not monitored. this is ultimately our fault for not having a proper SECURITY.md on our main repository the issue that was reported was fixed as soon as we heard about it - going through the process of learning about the CVE process, etc now and setting everything up correctly. we get 100s of issues reported to us daily across various mediums and we're figuring out ho…

Fixed? You just change it to be off by default giving the security burden to your users. It's not fixed it's buried with minimal mitigation and you give no indication to your users that it will make your machine vulnerable if activated. Shady.

Actually as of v1.1.15 it is fixed: https://github.com/anomalyco/opencode/releases/tag/v1.1.15

Re: Unauthenticated remote code execution in OpenCode

#132

Post by liveoneggs »

staticassertion wrote: post #126
Rygian wrote: post #111

Earlier quoted context omitted.

Don't waste your time and money on funding bug bounties or "getting audits done". Your staff will add another big security flaw just the next day, back to square one. Spend that money in reorganizing your management and training your staff so that everyone in your company is onboard with https://owasp.org/Top10/2025/A06_2025-Insecure_Design/ .

If part of the problem was that no one was responding to a vulnerability report then a bug bounty program would potentially address that.

you just get spammed with the same three fake reports over and over

Re: Unauthenticated remote code execution in OpenCode

#133

Post by liveoneggs »

Rygian wrote: post #111
thdxr wrote: post #4

hey maintainer here we've done a poor job handling these security reports, usage has grown rapidly and we're overwhelmed with issues we're meeting with some people this week to advise us on how to handle this better, get a bug bounty program funded and have some audits done

Don't waste your time and money on funding bug bounties or "getting audits done". Your staff will add another big security flaw just the next day, back to square one. Spend that money in reorganizing your management and training your staff so that everyone in your company is onboard with https://owasp.org/Top10/2025/A06_2025-Insecure_Design/ .

good try :)

Re: Unauthenticated remote code execution in OpenCode

#134

Post by ciberado »

tomrod wrote: post #72
kaliszad wrote: post #52

Many people seem to be running OpenCode and similar tools on their laptop with basically no privilege separation, sandboxing, fine-grained permissions settings in the tool itself. This tendency is reflected also by how many plugins are designed, where the default assumption is the tool is running unrestricted on the computer next to some kind of IDE as many authentication callbacks go to some port on localhost and th…

Hi. > Please run at least a dev-container or a VM for the tools. I would like to know how to do this. Could you share your favorite how-to?

If you are using VSCode against WSL2 or Linux and you have installed Docker, managing devcontainers is very straightforward. What I usually do is to execute "Connect to host" or "Connect to WSL", then create the project directory and ask VSCode to "Add Dev Container Configuration File". Once the configuration file is created, VSCode itself will ask you if you want to start working inside the container. I'm impressed with the user experience of this feature, to be honest.

Working with devcontainers from CLI wasn't very difficult [0], but I must confess that I only tested it once.

[0] https://containers.dev/supporting

Re: Unauthenticated remote code execution in OpenCode

#135

Post by pixl97 »

GoblinSlayer wrote: post #119
Rygian wrote: post #118

Earlier quoted context omitted.

It's called "the world wide web" and it works on the principle that a webpage served by computer A can contain links that point to other pages served by computer B. Whether that principle should have been sustained in the special case of "B = localhost" is a valid question. I think the consensus from the past 40 years has been "yes", probably based on the amount of unknown failure possibilities if the default was rev…

owasp A01 addresses this: Violation of the principle of least privilege, commonly known as deny by default, where access should only be granted for particular capabilities, roles, or users, but is available to anyone. Indeed, deny by default policy results in unknown failure possibilities, it's inherent to safety.

>Violation of the principle of least privilege

I completely agree with this, programs are too open most of the time.

But, this also brings up a conundrum...

Programs that are wide open and insecure typically are very forgiving of user misconfigurations and misunderstandings, so they are the ones that end up widely adopted. Whereas a secure by default application takes much more knowledge to use in most cases, even though they protect the end user better, see less distribution unless forced by some other mechanism such as compliance.

Re: Unauthenticated remote code execution in OpenCode

#136

Post by staticassertion »

liveoneggs wrote: post #132
staticassertion wrote: post #126

Earlier quoted context omitted.

If part of the problem was that no one was responding to a vulnerability report then a bug bounty program would potentially address that.

you just get spammed with the same three fake reports over and over

Triage is something that these services provide, exactly to deal with that.

Re: Unauthenticated remote code execution in OpenCode

#137

Post by pixl97 »

Just looking at some other stuff in this page and it seems it may have a few SSRFs.

Also it uses astro 5.7.13 that may have an SSRF of it's own. No idea if would be exploitable, but way out of date packages with potential security risks are a good place to start looking.

Re: Unauthenticated remote code execution in OpenCode

#138

Post by Cornbilly »

Rygian wrote: post #110
rtaylorgarlock wrote: post #7

Earlier quoted context omitted.

Respect for openness. Good work and good luck.

I don't understand what is being encouraged here. Something is seriously wrong when we say "hey, respect!" to a company who develops an unauthenticated RCE feature that should glaringly shine [0] during any internal security analysis, on software that they are licensing in exchange for money [1], and then fumble and drop the ball on security reports when someone does their due diligence for them. If this company want…

I’ve noticed this a lot with startup culture.

It’s like an unwritten rule to only praise each other because to give honest criticism invites people to do the same to you and too much criticism will halt the gravy train.

Re: Unauthenticated remote code execution in OpenCode

#139

Post by yawaramin »

exe34 wrote: post #103
yawaramin wrote: post #86

Earlier quoted context omitted.

Hi. You are clearly an LLM user. Have you considered asking an LLM to explain how to do this? If not, why not?

would an LLM have a favourite tool? I'm sure it'll answer, but would it be from personal experience?

I checked with Gemini 3 Fast and it provided instructions on how to set up a Dev Container or VM. It recommended a Dev Container and gave step-by-step instructions. It also mentioned VMs like VirtualBox and VMWare and recommended best practices.

This is exactly what I would have expected from an expert. Is this not what you are getting?

My broader question is: if someone is asking for instructions for setting up a local agent system, wouldn't it be fair to assume that they should try using an LLM to get instructions? Can't we assume that they are already bought in to the viewpoint that LLMs are useful?

Post reply on HN