GHSA-632h-h47v-g4x4: any web page could make OpenCode's local server install and run an attacker's package

Vulnerability · OpenCode · HIGH

Incident dateNot stated

DisclosedSep 24, 2026 (Datadog Security Labs write-up and Anomaly's GitHub advisory, published together). Fix released Aug 24, 2026 in OpenCode 1.18.22.

Added hereOct 15, 8:18 AM ET

Last verifiedOct 15, 2026

Summary

Datadog Security Labs found that the local server OpenCode starts with opencode serve or opencode web would install whatever its /global/upgrade endpoint was told to. On installs managed by npm, pnpm or Bun, that target could be a link to an attacker's package, and installing it ran the package's install scripts. The endpoint did not check where a request came from and read plain-text bodies as JSON, so any web page the developer opened could send the request through the browser. OpenCode 1.18.22, released Aug 24, 2026, fixes it. Affected versions are 1.14.30 through 1.18.21. Anomaly, which develops OpenCode, published the advisory on Sep 24 and rates it CVSS 7.5 High. It chose not to request a CVE.

Severity

HIGH Anomaly's advisory scores it CVSS 3.1 7.5 High: network attack, high complexity, no privileges, user interaction required (opening a page), and high impact on confidentiality, integrity and availability. It only applies while the OpenCode server is running, without a password or with Basic auth credentials cached in the browser, on an npm, pnpm or Bun install. Neither the advisory nor Datadog reports exploitation.

Timeline

Apr 2026
PR #24853 adds the vulnerable code path; OpenCode 1.14.30 is the first affected release (per Datadog).
Aug 11, 2026
Datadog Security Labs finds the flaw and reports it through GitHub Security Advisories.
Aug 24, 2026
Anomaly merges fix PR #44686 and releases OpenCode 1.18.22. At Anomaly's request, Datadog holds its write-up for a month to give users time to update.
Sep 24, 2026
Datadog publishes its write-up and Anomaly publishes GHSA-632h-h47v-g4x4.

How it happened

When OpenCode was installed through npm, pnpm or Bun, the upgrade handler passed the requested target straight into a command such as npm install -g opencode-ai@<target>. npm accepts a remote tarball URL there as well as a version number, so a URL to an attacker's package got installed and its preinstall script ran. Browsers will not send a cross-origin JSON request without a CORS check, but an HTML form can POST a text/plain body as a normal page navigation. The handler parsed that body as JSON without checking the content type, so a form whose field name and value join into valid JSON got through. The fix in PR #44686 accepts only a valid version number as the target and enforces the request content type; 1.18.22 answers the malicious request with 415 Unsupported Media Type. Users who do not run opencode serve or opencode web are not exposed, and installs made with curl, Homebrew, Chocolatey or Scoop do not treat the target as a package, per the advisory. Datadog counted more than 647,000 npm downloads of affected versions from Sep 17 to 23, 2026, while noting that does not show how many people ran the server.

How to check your app

Update OpenCode to 1.18.22 or later, especially if you installed it with npm, pnpm or Bun.
To see how OpenCode was installed, run ls -l "$(command -v opencode)" (Datadog's suggested check).
Set OPENCODE_SERVER_PASSWORD when you run opencode serve or opencode web, and stop the server when you are not using it.
If you ran an affected version with the server up, look for globally installed npm packages you do not recognize.

Sources

Corrections and updates

None. Re-checked against every source on Oct 15, 2026.