7 ms·
Unauthenticated remote code execution in OpenCode
Previous versions of OpenCode started a server which allowed any website visited in a web browser to execute arbitrary commands on the local machine. Make sure you are using v1.1.10 or newer; see link for more details.
- deleted 8mo ago[deleted]
- AlexErrant 8mo agoThe disclosure timeline is concerning. Reported 2025-11-17, and multiple "no responses" after repeated attempts to contact the maintainers... not a good look.
- pama 8mo agoit looks like opencode developers now try to take it seriously: https://github.com/anomalyco/opencode/issues/6355#issuecomment-3740105995 https://github.com/anomalyco/opencode/issues/6355#issuecomme...
- BoredPositron 8mo agoKeeping the rce as vendor advisement tells you everything you need to know on how serious they are about the security of their users.
- bayarearefugee 8mo agohey man, chill out. everybody is vibecoding now, and dealing with massive security issues is bad vibes.
- deleted 8mo ago[deleted]
- thdxr 8mo agohey maintainer here we've done a poor job handling these security reports, usage has grown rapidly and we're overwhelmed with issues we're meeting with some people this week to advise us on how to handle this better, get a bug bounty program funded and have some audits done
- observationist 8mo agoGood luck, and thank you for eating the accountability sandwich and being up front about what you're doing. That's not always easy to do, and it's appreciated!
- heliumtera 8mo agoCongrats on owning this, good job, respect
- gpm 8mo agoI'd be curious to know what features need opencode.ai to be an allowed origin for the local server.
- kachapopopow 8mo agoapp.opencode.ai frontend
- grncdr 8mo agoI was investigating that for entirely unrelated reasons just yesterday and the answer so far seems to be "none". You can patch the server to serve the locally built frontend and it all works just fine.
- shimman 8mo agoHuh, I thought opencode was a volunteer project but it looks like it's a business with major backing from major players. Was opencode always set up like this? I could have sworn there was some project with a better governance model, guess not.
- seaal 8mo agohttps://github.com/opencode-ai/opencode https://github.com/opencode-ai/opencode there was also the competing opencode which because crush done by charm.sh people.
- falloutx 8mo agoYou are either thinking of crush, roocode or kilo, they all started around the same time and dont have backing from major players yet.
- lvl155 8mo agoThey keep adding features without maintaining the core. I stopped using it when they started selling plans. The main reason for Opencode was to use multiple models but it turns out context sharing across models is PIA and impractical right now. I went back to using Claude Code and Codex side by side. Having said that, there is definitely a need for open platform to utilize multiple vendors and models. I just don’t think the big three (Anthropic, OAI and Google) will cede that control over with so much money on the line.
- theshrike79 8mo agoAs someone who uses the two big C's, I can recommend ampcode[0] and Crush[1]+z.ai GLM as an addition. Amp can do small utility scripts and changes for free (especially if you enable the ads) and Crush+GLM is pretty good at following plans done by Claude or Codex [0] https://ampcode.com/ https://ampcode.com/ [1] https://github.com/charmbracelet/crush https://github.com/charmbracelet/crush
- deleted 8mo ago[deleted]
- Imustaskforhelp 8mo agoOkay I am genuinely curious by what you mean ads. This is the first time I heard of the concept of ads in something like these code agents
- Maxious 8mo agoThere's screenshots here, they're visually seperated from the actual response https://x.com/connorado/status/2009707660988559827 https://x.com/connorado/status/2009707660988559827
- Imustaskforhelp 8mo agoAn Ad based model although sucks, still feels like a decent model of income than companies which provide inference at loss making, interesting. I hate the Ad models but I am pretty sure that most code gets trained in AI anyway and the code we generate would probably not be valuable metric (usually) to the ad company. Interesting, what are your thoughts about it? Thanks for sharing this. Is the project profitable because I assume not, not sure how much advertisements costs would be there.
- rdtsc 8mo ago> Silent fix So did they fix it silently, without responding to the researcher, or they fixed the silent part where now user is made a aware that a website is trying to execute code on their machine.
- Hamuko 8mo agoIt's under "Vendor Advisory", so I'm guessing it's that they fixed it, but never informed any OpenCode users that there was a massive security vulnerability.
- miduil 8mo agoSeems `session/:id/shell` was also `session/:id/bash` and originally `session/:id/command` in some commits. Maybe I'm using GitHub code search wrongly, but it appears this was just never part of even a pull request - the practice of just having someone pushing to `dev` (default branch) which then will be tagged should perhaps also be revisited. (Several more commits under `wip: bash` and `feat: bash commands`) https://github.com/anomalyco/opencode/commit/7505fa61b9caa17f1ef358961d7e46beb3276ca9 https://github.com/anomalyco/opencode/commit/7505fa61b9caa17... https://github.com/anomalyco/opencode/commit/93b71477e6656005353ce8c71224a99170f4ae2f https://github.com/anomalyco/opencode/commit/93b71477e665600...
- throw_me_uwu 8mo agoWTF, they not just made unauthenticated RCE http endpoint, they also helpfully added CORS bypass for it... all in CLI tool? That silently starts http server??
- Hamuko 8mo agoI'm slightly surprised that the CORS policy wasn't just "*" considering how wide open the server itself was.
- gpm 8mo agoIt seems like it was prior to 1.0.216?
- throw_me_uwu 8mo agoThat's the point, it was! https://github.com/anomalyco/opencode/commit/7d2d87fa2c44e32314015980bb4e59a9386e858c https://github.com/anomalyco/opencode/commit/7d2d87fa2c44e32...
- lifetimerubyist 8mo agoIt’s a vibe, bro.
- never_inline 8mo agoSomeone tell the AI labs to stop training on tutorial code.
- Bridged7756 8mo agoJust run it in a sandbox, bro.
- fragmede 8mo agoHow's that plastic utensils at Anthropic's buffet analogy going now?
- zmmmmm 8mo agoThis is pretty egregious. And outside the fact the server is now disabled by default, once it's running it is still egregious: > When server is enabled, any web page served from localhost/127.0.0.1 can execute code > When server is enabled, any local process can execute code without authentication > No indication when server is running (users may be unaware of exposure) I'm sorry this is horrible. I really want there to be a good actual open cross-provider agentic coding tool, but this seems to me to be abusive of people's trust of TUI apps - part of the reason we trust them is they typically DON'T do stuff like this.
- glerk 8mo agoFactory’s droid is pretty good for a cross-provider solution.
- deleted 8mo ago[deleted]
- BrouteMinou 8mo agoWhy TUI apps in particular?
- forgotTheLast 8mo agoOn the one hand, with 1800 open issues and 800 open PRs (most of it probably AI generated slop) makes it a bit understandable for the maintainers to be slow to reply. On the other hand, the vulnerability is so baffling that I'll make sure to stay as far away as possible from this project.
- blackbear_ 8mo agoIsn't it insane that any web page can run a port scan in the first place? Who wants that? Meanwhile, running opencode in a podman container seems to stop this particular, err, feature.
- pamcake 8mo agoIf you use uBlock Origin you can enable the "Privacy -> Block Outsider Intrusion into LAN" filter list to mitigate this.
- pluralmonad 8mo agoThank you for mentioning this.
- bandrami 8mo agoAssuming your container is sufficiently locked down
- angry_octet 8mo agoThis is such an egregious lack of respect for users, you can't trust this organisation again, and the lack of responsiveness just signals that they don't consider it a problem. Users must signal to companies that this attitude is unacceptable by dumping them.
- heavyset_go 8mo agoIf you aren't blocking your browser from allowing sites to call to local services, you should: > Network Boundary Shield > The Network Boundary Shield (NBS) is a protection against attacks from an external network (the Internet) to an internal network - especially against a reconnaissance attack where a web browser is abused as a proxy. > The main goal of NBS is to prevent attacks where a public website requests a resource from the internal network (e.g. the logo of the manufacturer of the local router); NBS will detect that a web page hosted on the public Internet is trying to connect to a local IP address. NBS only blocks HTTP requests from a web page hosted on a public IP address to a private network resource; the user can allow specific web pages to access local resources (e.g. when using Intranet services). https://jshelter.org/nbs/ https://jshelter.org/nbs/
- capybarafriend 8mo agofwiw they should probably slow down a bit, even though they seem to be winning the race. they started selling their own subscription plan last week, and promptly committed all subscriber’s emails to the public repo > Hey - have some bad news. > We accidentally committed your email to our repo as part of a script that was activating OpenCode Black. > No other information was included, just the email on its own.
- JoshPurtell 8mo agolmao
- blibble 8mo agothe sloppers are just a parody of themselves at this point
- csomar 8mo agoThis has the crypto vibes all over it.
- bopbopbop7 8mo agoI can't believe they keep on forgetting to add "make it secure" to the end of their prompts.
- BenGosub 8mo agoIt feels that today security is secondary to growth. As long as your growing, a few incidents here and there aren't going to make a difference.
- Imustaskforhelp 8mo agoWell I feel like they will take security more in context from here on out. Atleast they didnt implode their communications like I see from some other companies. To be really honest, when you bet on AI agents, I feel like soemtimes you bet on the future of the product as well which is built by the people so you are basically betting on the people. I'd much rather bet/rely on people who are sensibile in communications in troubled times like this than who implode sometimes (I mean no offense to Coderabbit but this is what comes to my head right now) So moments like these become the litmus test of the products basically imo by seeing how people communicate etc.
- cindyllm 8mo ago[dead]
- deleted 8mo ago[deleted]
- kaliszad 8mo agoMany people seem to be running OpenCode and similar tools on their laptop with basically no privilege separation, sandboxing, fine-grained permissions settings in the tool itself. This tendency is reflected also by how many plugins are designed, where the default assumption is the tool is running unrestricted on the computer next to some kind of IDE as many authentication callbacks go to some port on localhost and the fallback is to parse out the right parameter from the callback URL. Also for some reasons these tools tend to be relative resource hogs even when waiting for a reply from a remote provider. I mean, I am glad they exist, but it seems very rough around the edges compared to how much attention these tools get nowadays. Please run at least a dev-container or a VM for the tools. You can use RDP/ VNC/ Spice or even just the terminal with tmux to work within the confines of the container/ machine. You can mirror some stuff into the container/ machine with SSHFS, Samba/ NFS, 9p. You can use all the traditional tools, filesystems and such for reliable snapshots. Push the results separately or don't give direct unrestricted git access to the agent. It's not that hard. If you are super lazy, you can also pay for a VPS $5/month or something like that and run the workload there.
- Imustaskforhelp 8mo agoI really like the product created by fly.io's https://sprites.dev/ https://sprites.dev/ for AI's sandboxes effectively. I feel like its really apt here (not sponsored lmao wish I was) Oh btw if someone wants to run servers via qemu, I highly recommend quickemu. It provides default ssh access,sshfs, vnc,spice and all such ports to just your local device of course and also allows one to install debian or any distro (out of many many distros) using quickget. Its really intuitive for what its worth, definitely worth a try https://github.com/quickemu-project/quickemu https://github.com/quickemu-project/quickemu I personally really like zed with ssh open remote. I can always open up terminals in it and use claude code or opencode or any and they provide AI as well (I dont use much AI this way, I make simple scripts for myself so I just copy paste for free from the websites) but I can recommend zed for what its worth as well.
- tomrod 8mo agoHi. > Please run at least a dev-container or a VM for the tools. I would like to know how to do this. Could you share your favorite how-to?
- ollien 8mo agoA coworker raised an interesting point to me. The CORS fix removes exploitation by arbitrary websites (but obviously allows full access from the opencode domain), but let's take that piece out for a second... What's the difference here between this and, for example, the Neovim headless server or the VSCode remote SSH daemon? All three listen on 127.0.0.1 and would grant execution access to another process who could speak to them. Is there a difference here? Is the choice of HTTP simply a bad one because of the potential browser exploitation, which can't exist for the others?
- winstonwinston 8mo agoIf you have a localhost server that uses a client input to execute code without authentication, that’s a local code execution vulnerability at the very least. It becomes a RCE when you find a way to reach local server over the wire, such as via browser http request. I don’t use VSCode you have mentioned so i don’t know how it is implemented but one can guess that it is implemented with some authentication in mind.
- mirashii 8mo agoNeovim’s server defaults to named pipes or domain sockets, which do not have this issue. The documentation states that the TCP option is insecure. VS Code’s ssh daemon is authenticated.
- ollien 8mo ago> Neovim’s server defaults to named pipes or domain sockets, which do not have this issue. The documentation states that the TCP option is insecure. Good note on pipes / domain sockets, but it doesn't appear there's a "default", and the example in the docs even uses TCP, despite the warning below it. https://neovim.io/doc/user/api.html#rpc-connecting https://neovim.io/doc/user/api.html#rpc-connecting (EDIT: I guess outside of headless mode it uses a named pipe?) > VS Code’s ssh daemon is authenticated. How is it authenticated? I went looking briefly but didn't turn up much; obviously there's the ssh auth itself but if you have access to the remote, is there an additional layer of auth stopping anyone from executing code via the daemon?
- tempaccsoz5 8mo agoSeems that OpenCode is YC-backed as well [0] [1]. I would've thought YC would encourage better cyber security practice than OpenCode have demonstrated here. [0]: https://www.ycombinator.com/companies/sst https://www.ycombinator.com/companies/sst [1]: https://anoma.ly/ https://anoma.ly/
- hsaliak 8mo agoWow and they have an Auth provider product too!
- deaux 8mo agoFlock (YC S17) Hardcoded the Password for America's Surveillance Infrastructure 53 Times [0] I have no idea where you got your internal image of YC-backed companies from, but it needs massive adjusting. [0] https://news.ycombinator.com/item?id=46555807 https://news.ycombinator.com/item?id=46555807
- notachatbot123 8mo agoYC is not about anything but money.
- greenchair 8mo agomove fast and break things culture
- jerrythegerbil 8mo agoI run mine on the public internet and it’s fine, because I put it behind auth, because it’s a tool to remotely execute code with no auth and also has a fully featured webshell. To be clear, this is a vulnerability. Just the same as exposing unauthenticated telnet is a vulnerability. User education is always good, but at some point in the process of continuing to build user-friendly footguns we need to start blaming the users. “It is what it is”, Duh. This “vulnerability” has been known by devs in my circle for a while, it’s literally the very first intuitive question most devs ask themselves when using opencode, and then put authentication on top. Particularly in the AI space it’s going to be more and more common to see users punching above their weight with deployments. Let em learn. Let em grow. We’ll see this pain multiply in the future if these lessons aren’t learned early.
- CyberShadow 8mo agoCan you share what made this behavior obvious to you? E.g. when I first saw Open Code, it looked like yet another implementation of Claude Code, Codex-CLI, Gemini-CLI, Project Goose, etc. - all these are TUI apps for agentic coding. However, from these, only Open Code automatically started an unauthenticated web server when I simply started the TUI, so this came as a surprise to me.
- AlexAltea 8mo agoRelated: https://news.ycombinator.com/item?id=46539718 https://news.ycombinator.com/item?id=46539718
- bandrami 8mo agoThe next few years are going to be a golden age for ops and security overtime
- hsbauauvhabzb 8mo agoCute you think those project teams won’t be outsourced to LLMs also.
- phyzome 8mo agowait, you're getting overtime pay?
- bandrami 8mo agoContracting is wonderful
- Spivak 8mo agoThis doesn't actually seem that bad to me? Browsers don't let random pages on the internet hit localhost without prompting you anymore so it's not like a random website could RCE you unless you're running an old browser—and at that point that's the browser's fault for letting web pages out of the sandbox. You shouldn't have to protect localhost from getting hit with random public websites. The rest is just code running as your user can talk to code running as your user. I don't really consider this to be a security boundary. If I can run arbitrary code by hitting a URL I accept that any program running as me can as well. Going above and beyond is praiseworthy (good for you turning on SELinux as an example) but I don't expect it by default.
- CyberShadow 8mo ago> Browsers don't let random pages on the internet hit localhost without prompting you anymore No, that's a Chrome-specific feature that Google added. It is not part of any standard, and does not exist in other browsers (e.g. Safari and Firefox). > The rest is just code running as your user can talk to code running as your user No, that assumes that there is only a single user on the machine, and there are either no forms of isolation or that all forms of isolation also use private network namespaces, which has not been how daemons are isolated in UNIX or by systemd. For example, if you were to ever run OpenCode as root, any local process can trivially gain root as well.
- Spivak 8mo agoHuh? I have this permission in Firefox right now. It looks like Safari handles this with the OS local network permission. True I did assume machines are single user, I haven't seen a shared computer in ages. Doing local development I have insecure/incomplete software listening on localhost all the time while developing it. And lots of people have passwordless sudo, or unprivileged access to the docker socket so protection against local processes running as me is not part of my threat model. And I know this is pretty dev centric but OpenCode is dev centric as well.
- CyberShadow 8mo ago
- kachapopopow 8mo agopeople run AI tools outside a sandbox? tf? the first thing I did with claude code is put it in a sandbox. come on people, docker and podman exist, please use them - it isolates you not only from problems like this but supply chain attacks as well. it also has superior compatibility, any person working on your project will have all the tools available to compile it since to build & run it you use a simple Containerfile. (rather outdated now: https://github.com/DeprecatedLuke/claude-loop https://github.com/DeprecatedLuke/claude-loop)
- blindseer 8mo agoLots of the same people that were behind: https://www.terminal.shop/ https://www.terminal.shop/ afaict, for that project they never went through PCI compliance. See original thread for more information: https://news.ycombinator.com/item?id=40228751 https://news.ycombinator.com/item?id=40228751 They seem to not have a lot of real world experience and/or throw caution to the wind and YOLO through security practices. I'd be weary using any of their products.
- yawaramin 8mo agoSee also https://x.com/astuyve/status/2010772489605951912 https://x.com/astuyve/status/2010772489605951912
- m3kw9 8mo agoVibe coding a coding CLI?
- troyvit 8mo agoIf you want to have some fun check out aider.chat. They actually log how much of each version was built by aider itself: https://github.com/Aider-AI/aider/releases https://github.com/Aider-AI/aider/releases
- thehamkercat 8mo agofwiw, maintainer of claude code has also said his december contribution for claude-code was 100% written by claude-code which introduced so many bugs that people unsubscribed
- never_inline 8mo agoI was about to try it out, having heard good things. But this leaves a very bad taste. Guess I will stick to aider and copy-pasting.
- rcarmo 8mo agoI had an interesting experience with OpenCode yesterday, and I was also sent that RCE: https://taoofmac.com/space/blog/2026/01/12/1830 https://taoofmac.com/space/blog/2026/01/12/1830
- GoblinSlayer 8mo ago>how LLMs leverage “knowledge” in a completely non-linear way. It saw goproxy.cn and used goproxy.cn, looks linear to me.
- dxuh 8mo agoI liked aider initially, but I keep running into problems, as the project seems largely unmaintained. I wanted to install OpenCode yesterday, but this somewhat turns me off. Are there any good model-agnostic alternatives? I am somewhat shocked there is not a lot of good open source CLI LLM code assistants going around.
- kmarc 8mo agoI'm in the same boat. Apparently a group of devs forked it: https://github.com/dwash96/cecli https://github.com/dwash96/cecli Haven't tried yet
- lifetimerubyist 8mo agoWhy does an agent need a web server to take remote commands in the first place???
- pixl97 8mo agoJust looking at some other stuff in this page and it seems it may have a few SSRFs. Also it uses astro 5.7.13 that may have an SSRF of it's own. No idea if would be exploitable, but way out of date packages with potential security risks are a good place to start looking.
- Bridged7756 8mo agoRunning a non deterministic model in your terminal, allowing it to run whatever commands it wants always seemed like such a fucking stupid thing to do to me. How can people just wing it, let alone when production code is involved is just baffling to me. 0 concern about security.