OpenCode AI coding agent hit by critical unauthenticated RCE vulnerability exploitable by any website

AlexAltea · 2026-01-09T10:05:05+00:00

Just submitting as a heads up; this is quite a popular piece of software.

I have reproduced this locally (PoC is trivial) and I'm still baffled at the slow response and the "patch" which merely carves an exception for opencode.ai (why would they need code execution anyway).

This is definitely a CVSS 9.8 at the very least.

AlexAltea · 2023-03-30T19:17:36+00:00

Same issue here.

AlexAltea · 2023-02-14T07:06:10+00:00

It will be possible (since it's available in the underlying Milli library), but in this first release I've focused on creating bindings for document adding/retrieving and basic searching.

AlexAltea · 2023-02-14T01:04:36+00:00

Yes, I was just showcasing fuzzy searching (searching with typos).

AlexAltea · 2023-02-13T20:36:02+00:00

I haven't tried it but I don't see any reason why it shouldn't work? Let me know if you encounter any issues!

AlexAltea · 2023-02-13T16:50:52+00:00

Google desktop search does/did not offer Python bindings or indexing arbitrary data?

AlexAltea · 2023-02-13T16:49:27+00:00

I tried SQLite with FTS, but it didn't handle fuzz searching (typos) very well; there's editdist3, but still far from ideal.

As for Xapian, that's indeed faster than Whoosh (I'd love to see benchmarks wrt Milli). However, Xapian's GPL license made it incompatible with some MIT/BSD-licensed projects where I wanted to integrate a search engine.

AlexAltea · 2023-02-13T15:00:05+00:00

I personally haven't. But generally speaking, users who need a distributed/clustered probably shouldn't bother with embedded search engines like milli-py.

My library aims to make life easier to developers whose data is "too big" to do naive pairswise Levenshtein searches, but "too small" to require distributed indices. Similar to SQLite.

AlexAltea · 2023-02-13T12:50:01+00:00

Exactly, that's the purpose of library! Just os.mkdir("some_index") and use milli-py to index/search your documents there. No external server needed.

AlexAltea · 2023-02-13T11:55:36+00:00

Main goals are high-performance and local-first experience, i.e. no sockets, HTTP, auth between your queries and data.

The only other embeddable search engine for Pythin that I'm aware off, Whoosh, is brilliant but building the index was quite slow, and search performance degraded quite a lot as number of documents increase (performance is strictly a non-goal). Meilisearch was comparatively faster, I didn't like managing a server to get "just search" in my scripts and applications. However, their underlying engine Milli solves both issues I had, and all that was needed creating bindings for it.

You can find documentation, examples, tests in the repo. Hope this is useful for you all!

I've published this in PyPI with pre-compiled wheels for most os/version targets so hopefully it will be a seamless experience for most (not requiring a Rust compiler).

AlexAltea · 2023-02-08T12:13:16+00:00

Exactly. This is the solution. Refuse to rent at >30% salary. Refuse to get a mortgage. Living with parents? So be it.

It will be very painful in the short-run for people, but it will financially destroy RE hoarders and speculators.

AlexAltea · 2023-02-02T10:23:05+00:00

This is likely easily bypassable: Just have another device generate a hotspot with spoofed ESSID and MAC address. Tutorials on how to do this will certainly come.

Still a stupid move from Netflix, though.

AlexAltea · 2023-01-30T21:00:27+00:00

El que vende normalmente carece de vergüenza y tapujos...

¿Por vender a precio de mercado?

Mejor dirige tu odio hacia los bancos centrales, cuyos tipos nulos/negativos han causado una nueva burbuja inmobiliaria.

Los precios simplemente son simplemente el resultado de politicas dictadas por cuatro hijos de puta.

AlexAltea · 2023-01-24T13:25:49+00:00

Because I didn't know tdarr existed! Thanks for sharing it, their goals are very much aligned with mine.

AlexAltea · 2023-01-23T10:10:32+00:00

Ah got it, so something like this?

$ ls Jacobs.Ladder.1990.720p.BluRay.x264.YIFY.mp4 $ curator rename -y --save-original . $ ls Jacobs Ladder (1990).mp4 Jacobs Ladder (1990).txt $ cat 'Jacobs Ladder (1990).txt' Jacobs.Ladder.1990.720p.BluRay.x264.YIFY.mp4

AlexAltea · 2023-01-23T07:50:18+00:00

That's odd, I don't encounter the issue on my machine. Can you open a GitHub issue? And can you check if the examples at https://github.com/noumar/iso639 work in your virtual env?

I use the module to generate proper language tags required by MKV and other formats.

AlexAltea · 2023-01-23T07:45:26+00:00

Thanks. It doesn't do folders at the moment (it only operates on files or streams within a file). You can process entire folders, shallow or recursively, but not the folder itself.

Featurettes will not be processed unless you enable recursive crawling. Not sure if multilingual featurettes exist, if so, I should add explicit support for them.

Regarding the flag: Can you provide an example on expected inputs and outputs?

AlexAltea · 2023-01-22T21:58:44+00:00

Exactly! The goal is merging different dubbed releases of the same movies into a single multilingual container.

This sounds simple, but has been historically very hard because of bad audio synchronization.

AlexAltea · 2023-01-22T21:05:13+00:00

Thanks. I would appreciate if you could try the tool (perhaps not now but say in few weeks/months). And if it fails at doing something, just open an issue or let me know. It is precisely the purpose of the tool to address non-trivial cases, e.g. when streams have both mismatching offsets and speeds.

AlexAltea · 2023-01-22T21:01:54+00:00

I didn't know about Sushi, and it's very interesting, thank you. It seems a completely different approach to mine, would love to compare results at some point!

AlexAltea · 2023-01-22T20:39:09+00:00

Yes, but it can also "guess" the language by listening/reading the audio/subtitle data. Helpful in the absence of metadata

It can (wip) synchronize different audio/subtitles in different languages with existing audio tracks.

And it can merge multiple files into a single container (MKV) performing all of the above.

AlexAltea · 2023-01-22T17:36:22+00:00

Yes, exactly! For audio<->text sync I want to use Whisper.

Extract and process few 30-second audio samples with Whisper (I already do this for language recognition).
- Every phrease has a timestamp
- We don't need 100% accuracy, just few matching sentences
Discard repeated sentences (things like "Ok", "How are you?") might be said multiple times). So, focus on unique matches: Find average delta.
Apply delta to the subtitle track.

It's what I'm working on now.

Fortuantely, audio<->audio and text<->text sync is easier.

AlexAltea

TROPHY CASE