by Kastro
Paper/Archive/CVE-2026-22813

CVE-2026-22813

anomalyco opencode — Malicious website can execute commands on the local system through XSS in the OpenCode web UI

EPSS 0.9%public exploitCVSS 9.4
critical.is priorityof 100
50
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 59.8.598 × 2012.0Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

OpenCode is an open source AI coding agent. The markdown renderer used for LLM responses will insert arbitrary HTML into the DOM. There is no sanitization with DOMPurify or even a CSP on the web interface to prevent JavaScript execution via HTML injection. This means controlling the LLM response for a chat session gets JavaScript execution on the http://localhost:4096 origin. This vulnerability is fixed in 1.1.10.

Affected

ProductAffectedFixed inSource
opencode< 1.1.10–CNA

Scores by source

GitHub_M (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitgithub.com/anomalyco/opencode/security/advisories/GHSA-c83v-7274-4vgp