{"uuid": "39595403-c9a9-434e-92f4-f022ca843a5d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-632h-h47v-g4x4", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwcp7lzzrb2f", "content": "Datadog Security Labs disclosed GHSA-632h-h47v-g4x4 in OpenCode: a content-type confusion bug in /global/upgrade enabled remote code execution via a crafted cross-origin form and malicious npm tarball. Fixed in 1.18.22. #OpenCode #RCE #Datadog", "creation_timestamp": "2026-09-25T02:15:44.375802Z"}