PT-2026-2316 · Opencode · Opencode

Albertspedersen · Published 2026-01-12 · Updated 2026-03-05 · CVE-2026-22813

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions OpenCode versions prior to 1.1.10

Description The software is an open source AI coding agent. The markdown renderer used for responses from large language models inserts arbitrary HTML into the Document Object Model (DOM) without sanitization. There is no Content Security Policy (CSP) implemented on the web interface to prevent JavaScript execution through HTML injection. This allows an attacker to control the large language model response for a chat session and achieve JavaScript execution on the 'http://localhost:4096' origin.

Recommendations Update to version 1.1.10 or later.

Exploit

Fix

RCE

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-22813

GHSA-C83V-7274-4VGP

Affected Products

Opencode

References · 14

• 🔥 https://github.com/anomalyco/opencode/security/advisories/GHSA-c83v-7274-4vgp · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22813.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-22813 · Security Note
• https://osv.dev/vulnerability/CVE-2026-22813 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c83v-7274-4vgp · Vendor Advisory
• https://github.com/anomalyco/opencode · Note
• https://twitter.com/pulsepatchio/status/2011448399745499146 · Twitter Post
• https://twitter.com/0dayPublishing/status/2010848265776820455 · Twitter Post
• https://twitter.com/elagentecapital/status/2029101397212385405 · Twitter Post
• https://twitter.com/CVEnew/status/2010853016505565494 · Twitter Post
• https://twitter.com/capxel_security/status/2029270888231666109 · Twitter Post
• https://t.me/cveNotify/149396 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2010873403624882265 · Twitter Post
• https://twitter.com/wastelandweekly/status/2029364198874951712 · Twitter Post