Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Unauthenticated remote code execution in OpenCode

cy.md

Post reply on HN
Print view View original

21–30 of 155 posts

Re: Unauthenticated remote code execution in OpenCode

#21

Post by Y_Y »

bopbopbop7 wrote: post #13
thdxr wrote: post #4

hey maintainer here we've done a poor job handling these security reports, usage has grown rapidly and we're overwhelmed with issues we're meeting with some people this week to advise us on how to handle this better, get a bug bounty program funded and have some audits done

Why not just ask Claude to fix the security issues and make sure they don't happen again?

Talk about kicking someone while they're down...

Re: Unauthenticated remote code execution in OpenCode

#22

Post by seaal »

shimman wrote: post #18

Huh, I thought opencode was a volunteer project but it looks like it's a business with major backing from major players. Was opencode always set up like this? I could have sworn there was some project with a better governance model, guess not.

https://github.com/opencode-ai/opencode there was also the competing opencode which because crush done by charm.sh people.

Re: Unauthenticated remote code execution in OpenCode

#23

Post by lvl155 »

They keep adding features without maintaining the core. I stopped using it when they started selling plans. The main reason for Opencode was to use multiple models but it turns out context sharing across models is PIA and impractical right now. I went back to using Claude Code and Codex side by side.

Having said that, there is definitely a need for open platform to utilize multiple vendors and models. I just don’t think the big three (Anthropic, OAI and Google) will cede that control over with so much money on the line.

Re: Unauthenticated remote code execution in OpenCode

#25

Post by Hamuko »

rdtsc wrote: post #24

> Silent fix So did they fix it silently, without responding to the researcher, or they fixed the silent part where now user is made a aware that a website is trying to execute code on their machine.

It's under "Vendor Advisory", so I'm guessing it's that they fixed it, but never informed any OpenCode users that there was a massive security vulnerability.

Re: Unauthenticated remote code execution in OpenCode

#26

Post by miduil »

Seems `session/:id/shell` was also `session/:id/bash` and originally `session/:id/command` in some commits.

Maybe I'm using GitHub code search wrongly, but it appears this was just never part of even a pull request - the practice of just having someone pushing to `dev` (default branch) which then will be tagged should perhaps also be revisited.

(Several more commits under `wip: bash` and `feat: bash commands`)

https://github.com/anomalyco/opencode/commit/7505fa61b9caa17...

https://github.com/anomalyco/opencode/commit/93b71477e665600...

Re: Unauthenticated remote code execution in OpenCode

#27

Post by grncdr »

gpm wrote: post #12

I'd be curious to know what features need opencode.ai to be an allowed origin for the local server.

I was investigating that for entirely unrelated reasons just yesterday and the answer so far seems to be "none". You can patch the server to serve the locally built frontend and it all works just fine.

Re: Unauthenticated remote code execution in OpenCode

#29

Post by falloutx »

thdxr wrote: post #4

hey maintainer here we've done a poor job handling these security reports, usage has grown rapidly and we're overwhelmed with issues we're meeting with some people this week to advise us on how to handle this better, get a bug bounty program funded and have some audits done

Its okay, if you can fix it soon, it should be fine.
Post reply on HN