Discovering and exploiting a remote code execution vulnerability in OpenCode (GHSA-632h-h47v-g4x4)

Datadog Security LabsSeptember 24, 2026AppSec Vulnerabilities

Datadog Security Labs discovered GHSA-632h-h47v-g4x4, a vulnerability in OpenCode's upgrade endpoint that, under certain conditions, allowed malicious webpages to execute code on developers' machines.

Summary from Datadog Security Labs.

Read the full article at Datadog Security Labs

Explained

The technology and terms in this story. Learn more

AttackRemote code execution · RCEA flaw that lets an attacker run their own code on someone else's machine over the network.

Discovering and exploiting a remote code execution vulnerability in OpenCode (GHSA-632h-h47v-g4x4)

Explained

More in AppSec

SANS Stormcast Monday, October 26th, 2026: PHP2Shell Exploit Reliability; Node.js Brotli Decoder RCE (CVE-2026-111497); Tailscale "Tailworm" Vulnerabilities; HPE ArubaOS 8/10 Patches 72 Flaws

Risky Bulletin: Brotli RCE is wrecking what's left of the internet

OpenSSL 4.1.0: What’s new, what’s removed, and what’s still broken

Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software

New Evidence Shows LiteLLM Secret-Stealing Workflows Ran 11 Days Before Supply Chain Attack