CVE-2026-88899: knowns before 0.31.0 External Control of Agent Working Directory via x-opencode-directory Header
knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode proxy endpoint. Remote attackers can supply arbitrary directory paths to execute file operations outside the project root on the host system.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenCode Agentto a version that resolves this vulnerability.Fixed in 0.31.0 - Compensating control
Restrict access to the /api/opencode proxy endpoint so only trusted clients can send the x-opencode-directory header (mitigate arbitrary directory path file operations outside the project root for versions known before 0.31.0).
Event History
Frequently Asked Questions
Which deployments require remediation?
knowns versions earlier than 0.31.0 are affected. Upgrade to version 0.31.0 or later.
Does an attacker need credentials or user interaction to exploit this issue?
No. The CVSS vector indicates no privileges are required and no user interaction is needed; exploitation is network-accessible.