CLAIM-2026-09-29-01

GitHub advisory GHSA-632h-h47v-g4x4, published 24 September 2026, records that a webpage could submit a cross-site request to the OpenCode HTTP server's /global/upgrade endpoint and cause installation of an attacker-specified package; rated High, CVSS 7.5, with CWE-346, CWE-352 and CWE-436.

Why it matters

The attack needs no model compromise and no prompt injection. The agent's own self-update path is the entry point, which is why model-level guardrails do not touch it.

Sources

• githubsecur2026crosssite
• datadogsecu2026discoveri