Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
anomalyco/opencode
dev @ 21b78c4
134
Fixes
2
CVEs
HIGH
Peak severity
31.6%
Coverage
Highlights
Auth Bypass: 47 prior fixes. Scrutinize any change in this area.
packages/opencode/src/session/index.ts: most-fixed (8 issues). Treat as high-risk during review.
51 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Subagents spawned from parent agents could bypass restrictions and inherit overly permissive default rules rather than strict parent rules. This has been patched multiple times by enforcing inheritance and denying privileges by default.
Path Traversal: The application frequently failed to enforce directory boundaries, allowing directory traversal via relative paths and Windows path separators. Mitigation requires strict canonicalization and prefix verification against the project root or workspace boundary.
Auth Bypass: Experimental and raw HTTP routes lacked cohesive authorization middleware, leading to potential unauthenticated API access. This was addressed by implementing unified basic/token authentication routing filters.