CVEvulnerability

CVE-2026-22812

8.8 HIGH Published 2026-01-12 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2026-01-12
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-306, CWE-749, CWE-942

Description

OpenCode is an open source AI coding agent. Prior to 1.0.216, OpenCode automatically starts an unauthenticated HTTP server that allows any local process (or any website via permissive CORS) to execute arbitrary shell commands with the user's privileges. This vulnerability is fixed in 1.0.216.

Affected configurations

• anoma opencode (< 1.0.216)

Related

Weakness · CWE (3)

  • CWE-306 Missing Authentication for Critical Functionality weakness
  • CWE-749 Exposed Dangerous Method or Function weakness
  • CWE-942 Permissive Cross-domain Security Policy with Untrusted Domains weakness

References