Knowns coding-agent proxy lets unauthenticated header inject arbitrary host directory into embedded AI agent

Knowns (knowns-dev/knowns) users·Knowns' embedded OpenCode AI coding agent, proxied via proxyOpenCode() in internal/server/server.goFixed

Knowns' HTTP proxy for its bundled OpenCode AI agent only injected the trusted project root into the x-opencode-directory header and ?directory query parameter when a client left them empty; any non-empty client-supplied value was forwarded unmodified to the OpenCode daemon, which used it unconditionally as the agent's working directory. A remote, unauthenticated attacker could send a single request such as POST /api/opencode/session with x-opencode-directory: /home/victim/.ssh and a prompt asking the agent to read id_rsa, and the agent's own file-read tool would return the SSH key; the same technique could direct the agent to write a reverse shell into ~/.bashrc.

Blast radius

Confirmed via PoC: full read/write/execute access to any directory reachable by the OpenCode daemon process on affected Knowns installations (versions ≤0.30.0), including SSH keys, AWS/.env credential files, and shell profiles/cron files — no disclosed count of exploited deployments; scored CVSS v4.0 10.0 (AV:N/AC:L/AT:N/PR:N/UI:N, full confidentiality/integrity/availability impact on both vulnerable and subsequent systems).

Root cause

Fail-open authorization check in the proxy — 'if header/param == empty, set it to activeRoot' — instead of fail-closed unconditional overwrite, so any attacker-supplied non-empty value passed straight through to an AI agent daemon that trusted the header as authoritative for its file tree, git interface, and tool execution scope.

How it was caught

Found and reported through coordinated disclosure (credited to security researcher(s) uziii2208 / Tong Hoang Gia) rather than caught by Knowns' own testing; no evidence in the advisory of in-the-wild exploitation before the report.

What changed

Knowns v0.31.0 removed the entire attack surface by deleting the OpenCode proxy (proxyOpenCode(), x-opencode-directory header, /api/opencode/* endpoints) as part of removing the Chat UI; the maintainers state there is no patch for versions before 0.31.0, only upgrade.

Take-awayWhen proxying requests into an AI agent runtime, never conditionally trust client-supplied scoping headers/params for the agent's working directory — always strip and unconditionally overwrite them server-side, since the agent will treat whatever directory it's given as fully authoritative for all its tool calls.