A critical vulnerability in openCode v1.18.26 allows unauthenticated attackers to perform unauthorized recursive directory deletion, posing a severe risk to system integrity and availability.

This vulnerability involves a lack of path validation within the Worktree.remove component, which enables an unauthenticated attacker to manipulate file system operations. By submitting a crafted payload, an attacker can force the application to perform recursive deletions of arbitrary directories.

The ability for an unauthenticated actor to delete critical directory structures on a host system represents a catastrophic risk to data availability and service continuity. With a CVSS score of 9.1, this flaw is categorized as critical, as it allows for significant destruction of system or application data without requiring any prior authentication or user interaction.

Immediate Action: Since a specific patch is not currently identified, administrators should restrict network access to the affected openCode component and monitor the environment for unauthorized file system activity.

Proactive Monitoring: Security teams should implement file integrity monitoring (FIM) to detect unexpected recursive directory deletions and review application logs for anomalous requests directed at the Worktree component.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block requests containing path traversal characters or suspicious patterns targeting the Worktree.remove endpoint.

Public Exploit Available: Unknown.

Given the critical severity and the potential for total data loss, organizations utilizing openCode v1.18.26 must prioritize this vulnerability. Until a vendor-supplied patch is released, ensure that the application is isolated from public-facing networks and apply strict access controls to prevent exploitation of the Worktree component.