Skip to content
OpenAdvisories

Package · npm

opencode-ai

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.4
    CVE-2026-22813

    Malicious website can execute commands on the local system through XSS in the OpenCode web UI

    OpenCode is an open source AI coding agent. The markdown renderer used for LLM responses will insert arbitrary HTML into the DOM. There is no sanitization with DOMPurify or even a CSP on the web interface to prevent JavaScript execution via HTML injection. Th…

    anomalyco opencode opencode-ai npm