Albertspedersen

**Name of the Vulnerable Software and Affected Versions** OpenCode versions prior to 1.1.10 **Description** The software is an open source AI coding agent. The markdown renderer used for responses from large language models inserts arbitrary HTML into the Document Object Model (DOM) without sanitization. There is no Content Security Policy (CSP) implemented on the web interface to prevent JavaScript execution through HTML injection. This allows an attacker to control the large language model response for a chat session and achieve JavaScript execution on the 'http://localhost:4096' origin. **Recommendations** Update to version 1.1.10 or later.

**Name of the Vulnerable Software and Affected Versions** JSONata versions 1.4.0 through 1.8.6 JSONata versions 2.0.0 through 2.0.3 **Description** A malicious expression can use the transform operator to override properties on the `Object` constructor and prototype, potentially leading to denial of service, remote code execution, or other unexpected behavior in applications that evaluate user-provided JSONata expressions. **Recommendations** For JSONata versions 1.4.0 through 1.8.6, update to version 1.8.7 or later to prevent exploitation. For JSONata versions 2.0.0 through 2.0.3, update to version 2.0.4 or later to prevent exploitation. As a temporary workaround, consider applying the manual patch provided to prevent exploitation.