CVE-2026-22812highCWE-306CWE-749CWE-942

CVE-2026-22812: high-severity vulnerability in anomalyco opencode

OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution

Published · Updated

Follow this CVE+ Monitor opencode+ Monitor opencode-ai

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

41Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 8.8epss 17%
OpenCode is an open source AI coding agent. Prior to 1.0.216, OpenCode automatically starts an unauthenticated HTTP server that allows any local process (or any website via permissive CORS) to execute arbitrary shell commands with the user's privileges. This vulnerability is fixed in 1.0.216.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
anomalyco · opencode
Related CVEs — anomalyco opencode

In the same product, most dangerous first.

CVE-2026-119025HIGHopen 7.2.0 before 11.0.0 OS Command Injection via PowerShell on WindowsEPSS 1.4%CVE-2026-22813CRITICALMalicious website can execute commands on the local system through XSS in the OpenCode web UIEPSS 0.9%