CLAIM-2026-09-29-02
Datadog Security Labs reports the affected range as OpenCode 1.14.30 through 1.18.21 - 82 releases - with the fix in v1.18.22; the vulnerable code was introduced on 29 April 2026 and first released on 30 April 2026 in v1.14.30.
Why it matters
An engineer checking whether they are on a recent version is not protected. The window is four months wide and 82 releases deep.
Sources
- datadogsecu2026discoveri
- githubsecur2026crosssite