High · published January 12, 2026
⚡ An open HTTP server is unwittingly your own personal command center! Before version 1.0.216, OpenCode let any local process—or even nearby websites—execute shell commands as if they were you! Think of it like a restaurant with an open kitchen: diners can just walk up and ask the chef to make whatever they want. Without a guardrail in place, anyone could request a dish with strange ingredients—or worse, malicious orders! This vulnerability could allow a sneaky attacker to seize control of your system and run any commands with your privileges. Imagine them changing passwords, accessing sensitive data, or even worse, disrupting your entire environment! It's an open invitation to chaos, and that’s absolutely devastating!
Think of it like a restaurant with an open kitchen: diners can just walk up and ask the chef to make whatever they want. Without a guardrail in place, anyone could request a dish with strange ingredients—or worse, malicious orders! OpenCode's misconfigured unauthenticated HTTP server prior to version 1.0.216 allows any local process—and even websites via permissive CORS—to execute arbitrary shell commands as the current user. This oversight lacks the necessary authentication checks.
This vulnerability could allow a sneaky attacker to seize control of your system and run any commands with your privileges. Imagine them changing passwords, accessing sensitive data, or even worse, disrupting your entire environment! It's an open invitation to chaos, and that’s absolutely devastating! To protect your system, immediately update OpenCode to version 1.0.216 or higher. Additionally, review your CORS settings to ensure they aren't too permissive. A little diligence now goes a long way! You've got this! By taking these steps, you can lock down your system and keep the digital villains at bay! 🛡️