CVE-2026-88624

CriticalCVSS 9.1

Published: 22/09/2026(UTC)Updated: 23/09/2026(UTC)Translated: 23/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

9th percentile - higher than 9% of all known CVEs

Summary

Missing path validation in the Worktree.remove component of openCode v1.18.26 allows attackers to execute arbitrary recursive directory deletion via a crafted payload.

Risk Assessment

This can lead to irreversible deletion of filesystem data, causing data loss and service disruption.

Recommendation

Update openCode to a patched version or restrict access to the Worktree.remove functionality to trusted users only.

Other vulnerabilities in openCode

CVE-2026-22812High
OpenCode, an open source AI coding agent, prior to version 1.0.216 automatically starts an unauthenticated HTTP server that allows any local process (or any website via permissive CORS) to execute arbitrary shell commands with the user's privileges. This vulnerability is fixed in version 1.0.216.

Original NVD description (English source)

Missing path validation in the Worktree.remove component of openCode v1.18.26 allows attackers to execute arbitrary recursive directory deletion via a crafted payload.