5 ms·
WTF, they not just made unauthenticated RCE http endpoint, they also helpfully added CORS bypass for it... all in CLI tool? That silently starts http server??
by throw_me_uwu 8mo ago
WTF, they not just made unauthenticated RCE http endpoint, they also helpfully added CORS bypass for it... all in CLI tool? That silently starts http server??
- Hamuko 8mo agoI'm slightly surprised that the CORS policy wasn't just "*" considering how wide open the server itself was.
- gpm 8mo agoIt seems like it was prior to 1.0.216?
- throw_me_uwu 8mo agoThat's the point, it was! https://github.com/anomalyco/opencode/commit/7d2d87fa2c44e32314015980bb4e59a9386e858c https://github.com/anomalyco/opencode/commit/7d2d87fa2c44e32...
- lifetimerubyist 8mo agoIt’s a vibe, bro.
- never_inline 8mo agoSomeone tell the AI labs to stop training on tutorial code.
- Bridged7756 8mo agoJust run it in a sandbox, bro.