opencode vulnerabilities

CVEs whose affected-version data names the opencode package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-119025High· 7.5PoC

6d ago

open 7.2.0 before 11.0.0 OS Command Injection via PowerShell on Windows

open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL. Attackers can embed $(...) subexpressions in URLs, such as OAuth autho…

▾ Midnightsindresorhus · openEPSS 1.4%via CVEORG