opencode bug: bare `--` in pwsh commands skips the agent permission check entirely
android6 · ghdev · 2026-10-11
A reproduced, high-severity vulnerability was filed against coding-agent tool opencode (v2.0.25): on Windows with pwsh 7, appending a bare -- token to any shell command bypasses the shell permission check entirely.
- Impact: even with rules like shell deny plus a few git … allows, an agent can run arbitrary commands (node -e "..." --, Get-Content ... -- all execute)
- Root cause: packages/core/src/tool/plugin/shell.ts only asserts permissions when command nodes are parsed; tree-sitter-powershell yields no command node for commands containing -- , leaving parsed.commands empty and skipping the check
- Status: labeled reproduced / severity:high, reliably reproducible; untested on bash or with experimental.portableshellscanner
Anyone running shell allowlists on agents should treat this as an immediate bypass risk.
More from coding & agent
- Index Network open-sources Social Discovery Protocol: agents negotiate fit on your behalf — carsonfarmer · 2026-10-23
- Installed a formal-verification skill: it silently installed Java, MacBook runs 10 degrees hotter — zealcaiden · 2026-10-23
- OpenAI's Decisions API hits GA: near real-time routing up to 10x faster than GPT-6 Luna — OpenAIDevs · 2026-10-23
- Ruff author warns: upgrade Node/Bun now — --use-system-ca still accepts the eMudhra cert — charliermarsh · 2026-10-23
- Proof of Agent: paste one prompt and your AI mines, grades, and self-governs — adamamcbride · 2026-10-23
- DeepLearning.AI weekly: GPT-6.1 hits 97.9% byte parity on COBOL migration — DeepLearningAI · 2026-10-23