CVE-2026-22812

HIGH SEVERITY

CVSS Score & Metrics

Base Score

8.8 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H                                    

Vulnerability Description

OpenCode is an open source AI coding agent. Prior to 1.0.216, OpenCode automatically starts an unauthenticated HTTP server that allows any local process (or any website via permissive CORS) to execute arbitrary shell commands with the user's privileges. This vulnerability is fixed in 1.0.216.

Vulnerability Details

Published Date

January 12, 2026

Last Modified

January 21, 2026

CWE ID

CWE-306

Source

NVD

Vendor

anoma

Product

opencode

External References

https://github.com/anomalyco/opencode/security/advisories/GHSA-vxw4-wv6m-9hhh
https://github.com/anomalyco/opencode/security/advisories/GHSA-vxw4-wv6m-9hhh

CVE-2026-22812

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment