OpenCode adoption: 200,000+ GitHub stars, 16 million monthly users (Source: Datadog Security Labs, citing OpenCode's website (September 2026))
A browser tab, not a network attacker, was enough
Datadog Security Labs disclosed a remote code execution vulnerability in OpenCode, an open-source AI coding agent, tracked as GHSA-632h-h47v-g4x4. The flaw let a malicious webpage trigger code execution on a developer's machine simply by having them visit it while OpenCode's local web interface was running — no direct network access to the victim required. OpenCode's developer, Anomaly, fixed the issue in version 1.18.22.
How the exploit chained together
OpenCode's web interface, started with opencode serve or opencode web, requires no authentication by default. Its /global/upgrade API endpoint accepts a version string or a remote package URL and installs it via npm, pnpm, or Bun — including running any preinstall script the package contains. Datadog researchers found the endpoint's handler parsed request bodies as JSON without checking the declared Content-Type header. That mismatch let an HTML form — submitted as a top-level page navigation, a request type that current browser protections such as CORS and Chrome's Local Network Access do not block — deliver a JSON-shaped payload pointing to an attacker-hosted package. Once fetched and installed, the package's preinstall script executed on the victim's machine.
Exploitation required three conditions: the installed OpenCode version fell in that range, the local server was running without password authentication (or a browser held cached credentials), and OpenCode was installed via npm, pnpm, or Bun rather than another method. Datadog notes the vulnerability is exploitable only when all three hold — it did not estimate how many running instances met them.
The fix, and a disclosure choice worth noting
Anomaly merged the fix in PR #44686 on August 24, 2026 (commit c6e76e9). The patch does two things: it restricts the upgrade target to a valid semantic version string, closing off arbitrary package URLs, and it replaces the raw JSON parser with one that checks the Content-Type header before decoding, closing the form-submission path. OpenCode 1.18.22 now rejects the same cross-origin request with an unsupported media type response. Anomaly did not request a CVE for the flaw, stating it wanted to avoid incentivizing high-volume, low-quality vulnerability reports submitted through GitHub Security Advisories alone — meaning organizations tracking exposure by CVE feed will not see this one listed.
What to ask your team
AI coding agents that run a local server are becoming a normal part of developer workflows, and this disclosure shows that server can be a reachable attack surface even without exposing it to the network. Budget-holders overseeing engineering tooling should ask: which AI coding agents or local dev tools do our engineers run, and do their local servers require authentication by default? Do we have a way to confirm developers are on patched versions — GHSA and vendor advisories, not just CVE feeds, since this flaw carries no CVE? And does policy require closing or password-protecting any local agent interface before browsing the open web on the same machine?
