CVE-2026-22812highCWE-306CWE-749CWE-942

CVE-2026-22812: fallo de gravedad alta en anomalyco opencode

OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear opencode+ Monitorear opencode-ai

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

41Vexday Risk Score

Corrige pronto. Ella tiene exploit funcional público.

ssvc Attendcvss 8.8epss 17%
OpenCode is an open source AI coding agent. Prior to 1.0.216, OpenCode automatically starts an unauthenticated HTTP server that allows any local process (or any website via permissive CORS) to execute arbitrary shell commands with the user's privileges. This vulnerability is fixed in 1.0.216.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Productos afectados
anomalyco · opencode
CVEs relacionadas — anomalyco opencode

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-119025HIGHopen 7.2.0 before 11.0.0 OS Command Injection via PowerShell on WindowsEPSS 1.4%CVE-2026-22813CRITICALMalicious website can execute commands on the local system through XSS in the OpenCode web UIEPSS 0.9%