OpenCode is an open source AI coding agent. In versions 1.14.30 through 1.18.21, the "/global/upgrade" endpoint of the "opencode serve" HTTP server parses a "text/plain" request body as JSON, does not validate the request Origin, and passes an arbitrary package specifier from the "target" field to the npm-compatible package manager. A malicious webpage can submit a cross-site form to the local server and make an npm, pnpm, or Bun managed installation install an attacker-controlled package, executing its lifecycle scripts and leading to remote code execution. This issue has been fixed in version 1.18.22.