OpenCode Drive-By RCE: Any Website Could Make the Local Server Install an Attacker's npm Package (GHSA-632h-h47v-g4x4)

OpenCode, the open-source AI coding agent, versions 1.14.30 through 1.18.21 installed via npm, pnpm, or Bun

Datadog Security Labs disclosed on September 24, 2026 that OpenCode's local `/global/upgrade` endpoint accepted a cross-origin POST from an ordinary HTML form. Sent as `text/plain` to slip past JSON validation, the request could specify an arbitrary npm package URL whose preinstall script then ran on the developer's machine, so visiting a malicious page was enough when the server was unauthenticated or browser credentials were cached. The 82 vulnerable versions were downloaded more than 647,000 times between September 17 and 23, 38.9% of all OpenCode downloads that week. Reported August 11, fixed in 1.18.22 on August 24; no CVE at the vendor's request

A privileged local agent API that trusted any request reaching localhost, with content-type confusion bypassing the only input check, and an upgrade path that runs install scripts from a caller-supplied package