Live data from Hacker News

OpenCode AI coding agent hit by critical unauthenticated RCE vulnerability

Post reply on HN

Print view View original

1–3 of 3 posts

OpenCode AI coding agent hit by critical unauthenticated RCE vulnerability

#1

Post by AlexAltea » Thu, Jan 08, 2026, 11:14 AM UTC

OpenCode AI coding agent hit by critical unauthenticated RCE vulnerability
github.com

Re: OpenCode AI coding agent hit by critical unauthenticated RCE vulnerability

#2

Post by rvz » Thu, Jan 08, 2026, 11:30 AM UTC

Probably nothing.

Re: OpenCode AI coding agent hit by critical unauthenticated RCE vulnerability

#3

Post by AlexAltea » Fri, Jan 09, 2026, 7:43 AM UTC

rvz wrote: post #2

Probably nothing.

Probably nothing based on what? I have reproduced the finding locally...

Any website can trivially run arbitrary code as the current user if OpenCode is installed; that's CVSS ~10.

Post reply on HN