CVE-2026-88899
A critical vulnerability (CVE-2026-88899) allows remote attackers to supply arbitrary directory paths in the x-opencode-directory request header to the /api/opencode endpoint. This flaw lets attackers perform file operations outside the intended project root on the host system. The issue exists in versions before 0.31.0 of the affected software.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Versions of the software before 0.31.0 that expose the /api/opencode endpoint. Typical users are developers or administrators running the application.
Real-world impact
An attacker could read, modify, or delete files on the host system, potentially compromising the entire server, installing malware, or exfiltrating sensitive data.
Why this severity
The CVSS score of 9.3 reflects the vulnerability’s high impact: attackers can execute arbitrary file operations with no authentication or user interaction, and the flaw is easy to exploit remotely.
What to do about it
- 01Upgrade the software to version 0.31.0 or later.
- 02Restart the application to apply the update.
NVD description
Timeline
- Sep 10, 2026 · 3d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 10, 2026 · 3d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.