OpenCode AI coding agent hit by critical unauthenticated RCE vulnerability (github.com) 3 points by AlexAltea 8mo ago ↗ HN
[–] rvz 8mo ago ↗ Probably nothing. [–] AlexAltea 8mo ago ↗ Probably nothing based on what? I have reproduced the finding locally...Any website can trivially run arbitrary code as the current user if OpenCode is installed; that's CVSS ~10.
[–] AlexAltea 8mo ago ↗ Probably nothing based on what? I have reproduced the finding locally...Any website can trivially run arbitrary code as the current user if OpenCode is installed; that's CVSS ~10.
2 comments
[ 3.0 ms ] story [ 18.5 ms ] threadAny website can trivially run arbitrary code as the current user if OpenCode is installed; that's CVSS ~10.