CLAIM-2026-09-29-06

Exploitation requires that the victim runs OpenCode 1.14.30-1.18.21 via opencode serve or opencode web without password authentication, installed through npm, pnpm or Bun, and visits an attacker-controlled webpage from a browser that can reach the server.

Why it matters

The precondition is a configuration choice, not a bug. An unauthenticated local server on a machine that also browses the web is the shape to look for across every agent, not just this one.

Sources

• datadogsecu2026discoveri
• githubsecur2026crosssite