Disclosed vulnerability
OpenCode: malicious webpage can execute commands on a developer's machine via the /global/upgrade endpoint
AIR-2026-0264 AIR record · 2026-09-opencode-global-upgrade-rce
From the supporting source
A content-type confusion in the /global/upgrade API endpoint made an underlying code injection flaw exploitablesecuritylabs.datadoghq.com
The record
Disclosed
2026-09-24
Vendor
OpenCode (open source)
Product
OpenCode
Risk domain
Access control and permissions › Privilege escalation
System type
Generative model
Who acted
AI was the target — a webpage reaches an unauthenticated local endpoint of the coding agent; no model action in the chain
Attack surface
Coding agent
Autonomy level
Assistant
Initial vector
Cross site request to local agent server
Impact type
Remote code execution
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
OpenCode 1.14.30 through 1.18.21 installed via npm, pnpm or Bun and run as a local server; vulnerable versions had more than 647,000 downloads in one week
Capability abused
Defense & remediation
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
OpenCode 1.18.22
Taxonomy & references
Curator notes
Advisory GHSA-632h-h47v-g4x4; no CVE assigned. Reported by Datadog Security Labs. Exploitable only when the local OpenCode server is running and a victim visits an attacker-controlled page. The download figure measures exposure of vulnerable versions, not compromise; Datadog states it does not show how many users or machines were actually affected. No exploitation has been reported.
Supporting sources
Cite as
Enkrypt AI. "OpenCode: malicious webpage can execute commands on a developer's machine via the /global/upgrade endpoint". AIR, AIR-2026-0264. https://agentincident.vercel.app/i/AIR-2026-0264/ (accessed 2026-10-19).