EUVD-2026-84856
GHSA-fx2r-fm89-x94v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach openCode Worktree.remove sink
-
DeliverySupply crafted traversal path payload
-
ExploitBypass missing path validation
-
ExecutionTrigger recursive directory deletion
-
ImpactDestroy arbitrary files (integrity/availability loss)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to control the path argument passed to openCode's Worktree.remove component (a git-worktree removal routine) in openCode v1.18.26, supplying directory-traversal sequences that the missing validation fails to reject. Realistic reach depends on how the payload is delivered: openCode is an AI coding-agent developer tool, so the crafted path most plausibly arrives via its local server/API surface or via untrusted content the agent processes, rather than a classic anonymous internet endpoint. Limiting factors: the flaw affects only integrity/availability (arbitrary file/directory deletion, no data disclosure), and reachability presupposes that the openCode instance is running and its worktree-removal path is driven by attacker-influenced input; no non-default configuration is documented, but exposure is confined to hosts actually running openCode. |
| Impact | Signals conflict on real-world urgency. The vendor/NVD CVSS of 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) rates this critical on a pure destructive-impact basis (I:H/A:H from arbitrary recursive directory deletion, no confidentiality loss), but every exploitation-likelihood signal is low: EPSS is 0.19% (9th percentile), SSVC records Exploitation=none and Technical Impact=partial (not total), and there is no CISA KEV listing. Exploitation status: no public exploit identified at time of analysis - the sole reference is a third-party vuln-report GitHub issue, which is a writeup rather than confirmed weaponized exploit code. A material tension exists between the AV:N (network) rating and the nature of the affected component: openCode is an AI coding-agent/developer tool, and 'Worktree.remove' is a git-worktree operation, so a 'crafted payload' most plausibly reaches the sink via the tool's local API/server or via untrusted content the agent processes (e.g. prompt/tool-input injection) rather than a classic unauthenticated internet-facing service - verify the actual exposure surface with the vendor before treating this as remotely reachable by default. Net: this is a genuine high-impact destructive bug worth patching for openCode users, but the absence of active exploitation, low EPSS, and partial (not total) SSVC impact place it below actively-exploited internet-facing flaws in triage priority. |
| Exploit ScenarioDerived | An attacker supplies a crafted worktree path containing directory-traversal sequences (e.g. '../../') to openCode's Worktree.remove operation, which lacks path validation. Because the removal is a recursive delete, the operation wipes attacker-chosen directories outside the intended worktree, destroying source, config, or data on the victim's machine. No public proof-of-concept exploit code is confirmed - only a third-party vulnerability writeup exists. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Arbitrary recursive directory deletion is possible in openCode v1.18.26 because the Worktree.remove routine performs no validation on the path it is given, allowing traversal sequences to redirect deletion outside the intended git worktree. The independently assessed vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H) indicates the attack is network-reachable and needs no credentials but requires the victim to trigger the crafted path - realistically via openCode's local server/API surface or via untrusted content the AI coding agent processes - and the impact is limited to integrity and availability, with no data disclosure. No public exploit code has been identified at time of analysis, CISA KEV does not list this CVE, SSVC records Exploitation: none, and EPSS is low at 0.19% (9th percentile), so real-world urgency is currently driven by the severity of the deletion primitive rather than by observed attacks. Note the discrepancy between the vendor/NVD CVSS of 9.1 (UI:N) and the assessed 9.1-equivalent vector (UI:R), which the assessment treats as authoritative.
RemediationAI
No vendor-released patch identified at time of analysis: the supplied references contain no fixed version, no GitHub PR or commit, and no advisory stating patch availability, so upgrading to a specific corrected release cannot be prescribed from this data and users should track the openCode project and the NVD/EUVD records (https://nvd.nist.gov/vuln/detail/CVE-2026-88624, EUVD-2026-84856) plus the linked report at https://github.com/MyselfYangjz/vulnReport/issues/2 for a fix. Until a patch lands, the highest-value compensating control is to remove reachability of the worktree-removal path from attacker-influenced input: bind any openCode local server/API to loopback only and do not expose it to other hosts or untrusted networks (trade-off: breaks remote or multi-machine workflows and any client that expects a shared endpoint). Equally important, avoid running openCode's worktree-removal against paths derived from untrusted repositories, prompts, or agent-consumed content, and manually inspect/reject path arguments containing '../' or absolute paths before invoking removal (trade-off: manual steps slow automation and depend on operator discipline). Run openCode with a dedicated low-privilege account whose filesystem write scope is confined to disposable clone/worktree directories, and keep verified backups or snapshots of source trees so recursive deletion is recoverable (trade-off: containers and restricted accounts can hinder legitimate tooling that expects broad filesystem access, and snapshots consume storage). Do not rely on KEV status or exploit availability as a trigger - neither is confirmed here - but treat the destructive delete primitive and the low EPSS (0.19%) as a reason to prioritize exposure reduction over emergency patching while a fix is pending.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e. path traversal) in the Worktree.remove component of openCode v1.18.26, an AI coding-agent developer tool. Worktree removal is a git-worktree management routine: it takes a path identifying a linked worktree and deletes it, typically via a recursive removal equivalent to git worktree remove --force. Because the component does not canonicalize or validate the supplied path against the repository's worktree root, an attacker who controls that argument can embed traversal sequences (or an absolute path) and have the tool recursively delete directories well outside the intended worktree. The weakness class matters here: the failure is one of input validation/canonicalization, not of memory safety, so exploitation needs no special access beyond influencing the path argument. The assessed vector adds UI:R, reflecting that the deletion is triggered when the victim's openCode instance processes the crafted path - from its local server/API endpoint or from untrusted repository or agent-consumed content - whereas the published vector assumes no interaction. CPE data was not populated (cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*), so affected scope must be taken from the version string (v1.18.26) in the description and EUVD record rather than from a normalized CPE, and EUVD (EUVD-2026-84856) likewise lists no concrete product/version tuple. The impact profile (C:N/I:H/A:H) confirms the primitive is destructive rather than disclosive.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Destructive delete gives I:H/A:H, C:N; PR:N as no auth is documented, but a developer agent tool typically needs a victim to run/drive it, so UI:R lowers it below the vendor's UI:N 9.1.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Missing path validation in the Worktree.remove component of openCode v1.18.26 allows attackers to execute arbitrary recursive directory deletion via a crafted payload.
Executive ViewAI
openCode v1.18.26 contains a critical directory-deletion vulnerability, with no vendor-released patch identified at time of analysis, that can let a crafted path recursively delete files outside the intended git worktree and affect integrity and availability of developer environments. No public exploit code identified at time of analysis, and EPSS is low, but the issue is network-reachable and unauthenticated while requiring victim interaction, so a successful trigger could disrupt AI-assisted coding workflows or cause destructive data loss without exposing data. Leadership should treat affected installations as high operational risk until they are isolated, mitigated, or upgraded to a vendor-fixed release.
No vendor-released patch identified at time of analysis; interim mitigations include disabling or restricting Worktree.remove, limiting openCode local server/API exposure to trusted users and localhost, sandboxing and least-privilege execution, blocking untrusted content from AI agent processing, requiring explicit confirmation for deletion operations, maintaining immutable or offline backups, and monitoring for recursive deletion or path traversal.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Exploit-DB