Loading story…
Datadog Security Labs disclosed GHSA-632h-h47v-g4x4, a remote-code-execution flaw in the local web/API server of the OpenCode AI coding agent. OpenCode versions 1.14.30 through 1.18.21 accepted attacker-controlled upgrade targets that npm, pnpm, or Bun could resolve as remote package tarballs; package lifecycle scripts could then execute on the developer’s machine. A separate content-type validation weakness allowed a malicious website to send a cross-origin top-level text/plain form request containing JSON to the localhost upgrade endpoint, bypassing controls that would ordinarily prevent cross-origin JavaScript requests.
Exploitation requires a vulnerable OpenCode installation obtained through npm, pnpm, or Bun that is running opencode serve or opencode web without password authentication, or where the browser has cached authentication credentials. Anomaly corrected the package-target and request-content-type validation issues in OpenCode 1.18.22; organizations should upgrade affected developer endpoints and avoid exposing unauthenticated local OpenCode web services.
Track how attackers are adapting to this technology.
5 events from the most recent confirmed update back to the earliest known activity.
Anomaly published GHSA-632h-h47v-g4x4 after a one-month coordinated-disclosure delay requested following the patch release. The advisory describes remote code execution via the local OpenCode upgrade endpoint in versions 1.14.30 through 1.18.21.
Anomaly fixed the vulnerability in PR #44686 and commit c6e76e9, releasing OpenCode 1.18.22. The release restricts upgrade targets to valid semantic versions and enforces request content types, blocking the text/plain cross-origin exploit path.
Datadog Security Labs reported the GHSA-632h-h47v-g4x4 vulnerability to Anomaly through GitHub Security Advisories.
OpenCode 1.14.30, the first release affected by the upgrade-endpoint remote code execution flaw, was released.
OpenCode PR #24853 introduced the vulnerable upgrade code path, allowing arbitrary upgrade targets to reach package-manager installation commands.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
reddit.com
Open sourcesecuritylabs.datadoghq.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers disclosed two high-severity vulnerabilities in the open-source **OpenCode** AI coding agent that can allow **arbitrary command execution on a developer workstation** in drive-by scenarios. **CVE-2026-22812** stems from OpenCode automatically starting an **unauthenticated HTTP server** with **permissive CORS** (`Access-Control-Allow-Origin: *`), enabling any local process—or a malicious website via cross-origin requests—to invoke sensitive local API endpoints and execute shell commands with the user’s privileges. Separately, **CVE-2026-22813** is a **critical** issue in the OpenCode web UI where the markdown renderer can inject arbitrary HTML into the DOM without sanitization (no *DOMPurify* and no CSP), enabling JavaScript execution on the `http://localhost:4096` origin and subsequent access to local APIs that can spawn processes. Mitigations are available for both OpenCode issues: **CVE-2026-22812** is fixed in **OpenCode 1.0.216**, and **CVE-2026-22813** is fixed in **OpenCode 1.1.10**. Other items in the set describe unrelated vulnerabilities in different products (e.g., a command-injection flaw in an end-of-life VS Code extension, unsafe deserialization in *LlamaIndex*, ReDoS in *LangChain*, and various web app SQLi/XSS/access-control issues) and do not materially change the OpenCode risk picture; they should be tracked separately by affected-asset ownership and exposure.
Jun 29, 2026
Several open source projects disclosed serious vulnerabilities affecting developer and infrastructure tooling, including remote code execution, SQL injection, server-side request forgery, prompt-driven query injection, and path traversal. **Coder Workspace Agent** patched `GHSA-QRWJ-VH9X-GW5V`, a cross-agent SSRF flaw that let an authenticated attacker controlling one workspace agent abuse HTTP `307`/`308` redirects to replay privileged requests to another agent, enabling cross-tenant file access, file writes, and command execution; fixes were released in versions `v2.34.4`, `v2.33.10`, `v2.32.9`, and `v2.29.19 ESR`. **Coolify** disclosed a critical authenticated command injection issue tied to unsafe handling of deployment fields such as `dockerfile_location`, allowing RCE and secrets exposure through deployment logs, while **OpenRemote** fixed `GHSA-cgfv-jrfp-2r7v`, an authenticated SQL injection bug in datapoint crosstab export that could expose other tenants’ data, Keycloak configuration, and encrypted credentials. Additional disclosures affected AI and package-management components. **Langroid** fixed a prompt-injection-driven flaw in `Neo4jChatAgent` that executed LLM-generated Cypher without validation, allowing unauthorized graph operations and possible OS-level impact when dangerous Neo4j procedures were enabled; the issue was resolved in version `0.65.5` with new safety controls that were also extended to `ArangoChatAgent`. **pnpm** also reported a path traversal weakness in `configDependencies` processing from `pnpm-lock.yaml`, where a malicious repository could force symlink creation outside `node_modules/.pnpm-config` even with `--ignore-scripts`, creating a filesystem write primitive within or potentially beyond the project directory.
Jul 10, 2026
Ten malicious versions of **@7nohe/openapi-react-query-codegen**, a TanStack Query code generator with more than 150,000 weekly downloads, were published after an external GitHub user exploited its release workflow. The workflow accepted an exact npm-publish comment from any pull-request participant, checked out untrusted pull-request code, and used the repository's GitHub Actions OIDC trusted-publishing identity to release it; consequently, the malicious packages carried valid npm provenance attestations. At the time of reporting, npm's `latest` tag reportedly referenced malicious version `3.0.4`. The releases execute code during installation through preinstall hooks, malicious `binding.gyp` logic evaluated by `node-gyp`, or both, then launch an obfuscated second-stage payload. The malware downloads and executes Bun, probes Google Cloud metadata services, harvests credentials from cloud, GitHub, package registries, containers, Kubernetes, Vault, cryptocurrency wallets, messaging, VPN, and AI-development tools, and can propagate through accessible development environments; stolen data is exfiltrated through GitHub repositories labeled “Trinitite: Sponsored by Preview 2 Effects.” Organizations that installed affected versions with lifecycle scripts enabled should isolate and rebuild impacted systems, remove persistence and cached artifacts, and rotate all potentially exposed credentials from a clean environment using reviewed lockfiles and known-good releases.
Sep 1, 2026