Tong Hoang Gia (uziii2208)

knowns through 0.33.0 Authorization Bypass via project.set Bootstrap Exemption

knowns before 0.30.0 Unauthenticated Management API Exposure

knowns before 0.30.0 Path Traversal via templateFile parameter

knowns before 0.30.0 Path Traversal via Document API

knowns before 0.31.0 External Control of Agent Working Directory via x-opencode-directory Header

knowns through 0.33.0 Path Traversal via code.find MCP tool

knowns through 0.33.0 Arbitrary Directory Enumeration via workspace browse endpoint

knowns through 0.33.0 Path Traversal via Template Engine

OpenMAIC before 1.0.1 SSRF via Environment-Gated URL Validation

knowns before 0.30.0 Path Traversal via code.replace MCP action