CVE-2026-88624

Summary

This vulnerability allows attackers to execute arbitrary recursive directory deletion by exploiting missing path validation in the Worktree.remove component of openCode v1.18.26, posing a critical risk to system integrity.

Exploitability

Exploitation is relatively straightforward given a crafted payload, requiring the attacker to have access to the affected component.

Blast radius

If exploited, this could result in the complete loss of data and potentially the entire filesystem of the affected system.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to openCode v1.18.27 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.