Knowns

knowns through 0.33.0 fails to validate the path query parameter in the workspace browse endpoint, allowing remote attackers to enumerate arbitrary directories on the host filesystem. Attackers can traverse the directory structure to locate project directories and identify targets for further exploitation.

Published: 2026-09-10T15:28:54.733Z
Updated: 2026-09-11T11:08:00.490Z

knowns through 0.33.0 fails to properly validate template destination paths in the code generation template engine, allowing attackers to read and write arbitrary files outside the project root. Attackers can supply malicious templates that traverse directories to overwrite shell profiles, steal credentials, or achieve persistent code execution on victim systems.

Published: 2026-09-10T15:28:52.507Z
Updated: 2026-09-11T11:07:58.413Z

knowns through 0.33.0 exempts the project.set action from permission guard checks unconditionally, allowing read-only agent sessions to bypass restrictions. Attackers can invoke project.set to repoint the server at another project directory and obtain write access capabilities.

Published: 2026-09-10T15:28:53.963Z
Updated: 2026-09-15T14:40:10.438Z

knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode proxy endpoint. Remote attackers can supply arbitrary directory paths to execute file operations outside the project root on the host system.

Published: 2026-09-10T15:28:51.729Z
Updated: 2026-09-11T20:33:42.233Z

knowns through 0.33.0 fails to confine the path argument of the code.find MCP tool to the project root, allowing AI agent sessions to read source files anywhere on the host. Attackers can supply absolute paths or relative traversal sequences to the path argument and retrieve full file contents from outside the intended project directory.

Published: 2026-09-10T15:28:53.161Z
Updated: 2026-09-11T19:20:52.053Z