OpenCode silently patches critical remote code execution vulnerability in developer tool

Developers behind the open-source artificial intelligence coding tool OpenCode silently patched a critical remote code execution vulnerability, InfoSecurity Magazine reported on October 20. Pillar Security head of security research Eilon Cohen disclosed in an October 19 report that the flaw affects OpenCode versions 1.0.137 to 1.18.32. The security weakness reportedly impacts systems running Microsoft Windows and Windows Subsystem for Linux. [1]

InfoSecurity Magazine reported that the silent patch leaves users who run vulnerable versions unaware of the security risks. OpenCode is a widely used AI agent platform for software developers that has gathered over 218,000 stars on GitHub. The vulnerability allows remote code execution if an attacker successfully exploits the flaw. [1]

Code injection occurs when a program processes external input incorrectly, causing the system to interpret the data as executable commands, according to Wikipedia. Successful code injection vulnerabilities can allow attackers to gain unauthorized access to restricted systems or spread malware. [10]

The vulnerability disclosure follows earlier security trouble for the platform, as FTMQ Security reported earlier. On October 17, Anomaly Innovations notified roughly 1.4 percent of OpenCode Console users that a security breach exposed stored API keys for OpenAI, Anthropic, and Google cloud services. Anomaly Innovations urged all affected users to revoke and rotate exposed credentials immediately. [11]