Threats Tagged 'ghsa-w47m-jpv2-qfw5'

knowns versions before 0.31.0 contain a vulnerability in the /api/opencode proxy endpoint where the x-opencode-directory request header is not properly validated. This allows remote attackers to specify arbitrary directory paths, potentially enabling file operations outside the intended project root on the host system. The vulnerability has a critical severity with a CVSS 4.0 score of 9.3.