Executive brief
openCode is a development tool that manages file workspaces. Missing validation of file paths in its Worktree.remove component allows an attacker to delete arbitrary directories recursively, potentially destroying project data, backups, or critical application files.
Technical details
The Worktree.remove component fails to validate user-supplied file paths before performing recursive directory deletion. An attacker can craft a malicious payload specifying an arbitrary directory path to delete system or application files. The vulnerability appears exploitable without authentication or special privileges.
Affected products
- MyselfYangjz openCode v1.18.26
Timeline
- 2026-09-22: disclosed