Expired60% confidenceFactExact time
The server architecture enabled by default in OpenCode has a remote code execution vulnerability that has gone unpatched for a long time.
2
Sources
60%
Confidence
Medium-term (~90 days)
Relevance
7/2/2026
First Seen
Valid until: 9/30/2026(expired)
Sources
Related Claims
UnverifiedThe Heartbleed vulnerability in OpenSSL and the Log4Shell vulnerability in Log4j exposed systemic issues of insufficient maintenance resources for critical open-source projects.68% similarUnverifiedMany vulnerabilities are actually in an unexploitable state because the relevant code paths are never triggered at runtime, but vulnerability scanners cannot distinguish this, resulting in noisy alerts.67% similarUnverified开源模式带来商业化路径受限的挑战，且恶意用户可以研究代码寻找漏洞67% similarUnverifiedHistorical RouterOS vulnerabilities include CVE-2018-14847, a Winbox protocol vulnerability (allowing unauthorized users to read arbitrary files), and CVE-2019-3976, an SMB stack overflow (enabling remote code execution).66% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/43519API
curl https://kongchang.com/api/v1/knowledge/claims/43519MCP
get_claim(id=43519)