Skip to content
OpenAdvisories

Package · npm

opencode-ai

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Critical 9.4
    CVE-2026-22813

    Malicious website can execute commands on the local system through XSS in the OpenCode web UI

    OpenCode is an open source AI coding agent. The markdown renderer used for LLM responses will insert arbitrary HTML into the DOM. There is no sanitization with DOMPurify or even a CSP on the web interface to prevent JavaScript execution via HTML injection. Th…

    anomalyco opencode opencode-ai npm
  • High 8.8
    CVE-2026-22812 Public exploit EPSS 17%

    OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution

    OpenCode is an open source AI coding agent. Prior to 1.0.216, OpenCode automatically starts an unauthenticated HTTP server that allows any local process (or any website via permissive CORS) to execute arbitrary shell commands with the user's privileges. This …

    anomalyco opencode opencode-ai npm