Security Digest · Vulnerability record
CVE-2026-22813: Malicious website can execute commands on the local system through XSS in the OpenCode web UI
OpenCode is an open source AI coding agent.
CVSS 9.4 Critical EPSS 0.9% · p59
Should you act?
Critical and remotely reachable
No known exploitation yet, but it is network-reachable without credentials. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.
- Not in CISA KEV, but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
- EPSS 0.9%, percentile 59: FIRST’s model estimates a 0.9% chance of exploitation activity in the next 30 days, higher than 59% of all scored CVEs (moderate). EPSS is a probability, not a verdict.
- Only applies if your dependency tree includes
opencode-ai(npm) < 1.1.10, fixed in 1.1.10. Check your lockfile, including transitive dependencies.
What it is
OpenCode is an open source AI coding agent. The markdown renderer used for LLM responses will insert arbitrary HTML into the DOM. There is no sanitization with DOMPurify or even a CSP on the web interface to prevent JavaScript execution via HTML injection. This means controlling the LLM response for a chat session gets JavaScript execution on the http://localhost:4096 origin. This vulnerability is fixed in 1.1.10.
From the GitHub advisory
Summary A malicious website can abuse the server URL override feature of the OpenCode web UI to achieve cross-site scripting on http://localhost:4096. From there, it is possible to run arbitrary commands on the local system using the /pty/ endpoints provided by the OpenCode API.
Code execution via OpenCode API
- The OpenCode API has /pty/ endpoints that allow spawning arbitrary processes on the local machine. - When you run opencode in your terminal, OpenCode automatically starts an HTTP server on localhost:4096 that exposes the API along with a web interface. - JavaScript can make arbitrary same-origin fetch() requests to the /pty/ API endpoints. Therefore, JavaScript execution on http://localhost:4096 gets you code execution on local the machine.
JavaScript execution on localhost:4096
The markdown renderer used for LLM responses will insert arbitrary HTML into the DOM. There is no sanitization with DOMPurify or even a CSP on the web interface to prevent JavaScript execution via HTML injection.
Weakness type: CWE-79.
Product: opencode-ai (npm) · Assigned by: GitHub_M · Published: 2026-01-12
Affected and fixed versions
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| npm | opencode-ai | < 1.1.10 | 1.1.10 |
| Vendor | Product | Affected versions (per CVE record) |
|---|---|---|
| anomalyco | opencode | < 1.1.10 |
Severity scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_M | 4.0 | 9.4 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
| GitHub | 4.0 | 9.4 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
- Attack vector: network (remotely reachable)
- Attack complexity: low
- Attack requirements: none
- Privileges required: none (no login)
- User interaction: passive
CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.
Exploitation and urgency
- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation poc, automatable yes, technical impact total.
- FIRST EPSS (model of 2026-10-21): 0.91% probability of exploitation activity in the next 30 days; percentile 59.
Timeline
- — CVE record published by GitHub_M
- — CVE record last updated
- — GitHub-reviewed advisory GHSA-c83v-7274-4vgp published (critical)
Sources and references
Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.
Vulnerability records
- GitHub Advisory GHSA-c83v-7274-4vgp github.com
- CVE.org record CVE-2026-22813 cve.org
- NVD entry CVE-2026-22813 nvd.nist.gov
Other references from the CVE record and advisory
- github.com github.com