PT-2026-2315 · Opencode · Opencode

Cybershadow

·

Published

2026-01-12

·

Updated

2026-04-01

·

CVE-2026-22812

CVSS v2.0

10

High

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions OpenCode versions prior to 1.0.216
Description OpenCode, an open source AI coding agent, has an issue where it automatically starts an unauthenticated HTTP server. This allows any local process, or any website due to permissive CORS settings, to execute arbitrary shell commands with the privileges of the user running the application. The vulnerability allows for remote code execution. The issue is related to a lack of authentication for a critical function.
The vulnerable endpoint is /session/{id}/shell, where id is a session identifier. Exploitation involves sending a POST request to this endpoint without any authentication, enabling direct command execution.
Recommendations Update OpenCode to version 1.0.216 or later.

Exploit

Fix

RCE

Missing Authentication

Weakness Enumeration

CWE-942CWE-749CWE-306

Related Identifiers

BDU:2026-00783
CVE-2026-22812
GHSA-VXW4-WV6M-9HHH

Affected Products

Opencode