Discovering and exploiting a remote code execution vulnerability in OpenCode (GHSA-632h-h47v-g4x4)

Datadog Security Labs disclosed a remote code execution vulnerability (GHSA-632h-h47v-g4x4) in OpenCode where a content-type parsing flaw in the /global/upgrade endpoint allowed attackers to force vulnerable installations to fetch and install attacker-controlled npm tarballs, running arbitrary preinstall scripts. The write-up includes a working proof-of-concept (HTML form using text/plain enctype to bypass CORS and Local Network Access protections), enumerates affected versions (1.14.30–1.18.21 installed via npm/pnpm/Bun), and notes a fix in OpenCode 1.18.22 that restricts upgrade targets to semantic versions and enforces content-type checks.