CyberShadow’s homepage personal blog
Unauthenticated remote code execution in OpenCode
OpenCode is an open-source AI coding assistant. Prior to v1.1.10, it automatically spawned an HTTP server (default port 4096+) on startup. Since v1.1.10, the server is disabled by default but can be enabled via command-line flags or configuration file. When running, the server exposes endpoints for:
- Points
- 432
- HN comments
- 142
- Submissions
- 1
- Cited by
- 0 commenters
On Hacker News
| Submitted | Title on HN | Points | Comments |
|---|---|---|---|
| Jan 11, 2026 | Unauthenticated remote code execution in OpenCode by CyberShadow | 432 | 142 |
