CVE-2026-88624

Name of the Vulnerable Software and Affected Versions openCode version 1.18.26

Description Missing path validation in the Worktree.remove component allows attackers to perform arbitrary recursive directory deletion using a crafted payload. This issue is a path traversal flaw, which occurs when an application uses user-controllable input to construct a pathname that is then used in a file system operation, potentially allowing access to files or directories outside the intended folder.

Recommendations As a temporary workaround, restrict the use of the Worktree.remove component until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.