Skip to content
OpenAdvisories

Vendor

knowns-dev

14 known vulnerabilities.

Products

knowns 14
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.8
    CVE-2026-88899 Public exploit

    knowns before 0.31.0 External Control of Agent Working Directory via x-opencode-directory Header

    knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode proxy endpoint. Remote attackers can supply arbitrary directory paths to execute file operations outside the project root on the host system.

    knowns-dev knowns