Short answer: Datadog Security Labs reported a flaw in the local server that OpenCode starts with opencode serve or opencode web. In affected versions, a malicious web page you visit could make that server run commands on your machine. Versions 1.14.30 through 1.18.21 are affected, and the fix shipped in 1.18.22. If you use OpenCode in server or web mode, update to 1.18.22 or later, restart every running OpenCode process, and keep the server on localhost. The advisory is tracked as GHSA-632h-h47v-g4x4. I did not find a CVE number or a severity score in the sources I read.

Am I affected?

Four conditions that must all be true: affected version, npm or pnpm or Bun install, serve or web mode, and no password or cached credentials

Per Datadog, you are exposed only if all four conditions in the figure hold. Check your version with opencode --version. If it prints a number from 1.14.30 to 1.18.21 and you ever start the server or web interface, treat yourself as affected. If you only use the terminal interface and never run opencode serve or opencode web, the sources I read do not describe you as exposed, but updating is still cheap.

What went wrong?

The server had an upgrade endpoint, /global/upgrade, that passed input to a package install step without validating it. Datadog explains that a web page can submit a form to a local address as a top-level navigation using a text/plain content type, and that this route is not blocked by the browser protections people usually rely on, such as CORS and Local Network Access rules. So the page you are viewing, not an attacker on your network, is the one talking to your local server. I am leaving out the request details on purpose.

What did the fix change?

According to Datadog, Anomaly’s fix (PR #44686, released in v1.18.22) validates that the requested version is a proper semantic version and rejects text/plain requests with HTTP 415. Both changes close the path described above.

When did all this happen?

Timeline from April to September 2026: code introduced Apr 29, first affected release Apr 30, report Aug 11, fix Aug 24, publication Sep 24 Source: Datadog Security Labs. The code path came in with PR #24853 on Apr 29 and shipped in v1.14.30 on Apr 30.

Datadog reported the flaw privately on Aug 11, Anomaly shipped the fix on Aug 24, and the details were published on Sep 24. Datadog says it delayed publication by about a month at Anomaly’s request so users had time to update. That is a normal disclosure pattern, and it means anyone who updated after August was protected before the write-up appeared.

How many people could this reach?

Three tiles: 647,000+ downloads of vulnerable versions from Sep 17 to 23, 82 vulnerable releases, 38.9% of OpenCode downloads that week

Datadog reports more than 647,000 npm downloads of vulnerable versions in a single week, about 38.9% of OpenCode downloads then, across 82 vulnerable releases. Downloads are not unique users, and CI jobs and reinstalls inflate them. The figure also says nothing about how many people actually ran the server or web mode, which is the affected setup. Read it as “the vulnerable code was widespread,” not “647,000 people were exposed.”

What should I do now?

  1. Run opencode --version and note the number.
  2. Update to 1.18.22 or later with the same tool you installed it with (npm, pnpm or Bun).
  3. Quit and restart every running OpenCode process. An old process keeps running the old code until you do.
  4. Set OPENCODE_SERVER_PASSWORD if you use server or web mode. Datadog says a password reduces exposure but does not replace patching.
  5. Keep the server bound to localhost, and do not expose it to a network or the internet.
  6. If you ran an affected version in server mode and browse untrusted pages, review recent shell history and installed packages for anything you do not recognize.

For background on why tools like this deserve care, see what a sandbox is. For the project itself, see OpenCode, and for an earlier security story about the same project see the OpenCode console breach. You can also follow its activity on the tracker.

What I am unsure about

  • Whether anyone exploited this in the wild. The sources I read describe research and disclosure, not attacks.
  • Whether a CVE has been assigned. I only saw the GHSA identifier.
  • Which Windows, macOS or Linux setups are most at risk. The sources I read do not break this down.
  • The details of “cached credentials” in the auth condition. I report Datadog’s wording and did not test it.

FAQ

Is OpenCode safe to use now?

Version 1.18.22 and later contain the fix described by Datadog. As with any tool that runs commands for you, run it with a password in server mode and keep it off public networks.

Does a password fully protect me on an old version?

No. Datadog says a password reduces exposure but is not a substitute for updating.

Do I need to worry if I only use the terminal interface?

The sources describe the problem in opencode serve and opencode web. If you never start those, the described attack path does not apply, but updating costs little.

Is there exploit code in this post?

No. I summarized the idea and left out the request details.

Sources

Written with AI assistance and checked against the sources above. See About for how ossbeat works.