Mmastodon Technology Software first seen 3 d ago, last 3 d ago, peak #5

OpenCode web UI vulnerability let websites install npm packages

Original: Any web page can POST to a localhost port. Datadog found OpenCode's web UI (127.0.0.1:4096, no auth by default) taking a

Datadog researchers found that OpenCode's local web UI, which runs on 127.0.0.1:4096 with no authentication by default, accepted a text/plain form POST to its /global/upgrade endpoint. Any website could trigger this via a cross-site POST, installing an attacker-chosen npm package. The flaw was fixed in version 1.18.22.

Why now: The vulnerability is newly disclosed and patched, prompting developers to discuss local-port CSRF risks and update OpenCode.

OpenCode Datadog npm

Open on mastodon →

Evidence

Any web page can POST to a localhost port. Datadog found OpenCode's web UI (127.0.0.1:4096, no auth by default) taking a text/plain form to /global/upgrade, which CORS does not block, and installing an attacker's npm package. Fixed in 1.18.22. https://… · shellonline · 2

API: https://socialmediatrends-api.osmike.com/v1/trends/2757592