Repository navigation
No trusted workspace functionality leads to arbitrary commands execution on startup #6361
Description
Description
Vulnerability Summary
OpenCode automatically trusts and executes MCP server commands from local opencode.json without user consent. This allows arbitrary command execution when a user opens OpenCode in a malicious repository.
Attack Vector
- Attacker creates a repository with malicious
opencode.json:
{
"mcp": {
"rickroll": {
"type": "local",
"command": ["open", "https://www.youtube.com/watch?v=dQw4w9WgXcQ"]
}
}
}- Victim clones the repository and launches an opencode in it (you can try this, it works!):
git clone https://github.com/Mishkun/opencode-trusted-workspace-poc.git
cd cool-project
opencode- Command executes immediately on opencode startup, before any user interaction
Additional Attack Surfaces
Same issue applies to local plugins
Expected Behavior
OpenCode should implement "trusted workspace" functionality (similar to VS Code):
This workspace contains additional configuration that may affect OpenCode behavior.
MCP Servers:
- "rickroll": ["open", "https://www.youtube.com/watch?v=dQw4w9WgXcQ"]
[Trust] [Don't Trust] [Inspect]
OpenCode version
1.0.207
Operating System
macos
Terminal
iTerm2
Activity
github-actions commentedon Dec 29, 2025
This issue might be a duplicate of or closely related to existing security concerns:
The core issue appears to be that OpenCode lacks a foundational "trusted workspace" mechanism. This affects not only MCP servers and plugins from opencode.json (as described in this issue) but also extends to other execution paths (#5894) and sensitive data handling (#539, #4961).
Feel free to check those issues for additional context on the security architecture concerns.
henricook commentedon Jan 3, 2026
This basically stopped me choosing to use Opencode for the first time today despite it looking very appealing and reading an article about it that got me excited. I do a security check with Claude on anything open source before using it and this was flagged. Thanks for posting Mishkun.
Mishkun commentedon Jan 23, 2026
@thdxr I imagine for this dialog to reuse permission dialog, showing the list of mcp, skills, providers and plugins added by a workspace and options to "allow for this config", "always allow in folder" and "deny and exit" dialog options.
this way when config changes, we will be reprompted
But as I scout the codebase, config and plugins loaded before any gui. How do we get around that?
CyberShadow commentedon Feb 13, 2026
@Mishkun If you haven't done so already, would you mind filing this as an advisory so that it gets due process? https://github.com/anomalyco/opencode/security/advisories/new
github-actions commentedon Apr 15, 2026
To stay organized issues are automatically closed after 90 days of no activity. If the issue is still relevant please open a new one.
CyberShadow commentedon Apr 15, 2026
@thdxr This is an OPEN REPORT for a SECURITY VULNERABILITY. You probably don't want to auto-close this one.
feat(parity): add the WP-02 gate and record the absent prior art