Skip to content
Sign in
8.8 High

CVE-2026-22812 OpenCode is an open source AI coding agent

Description

OpenCode is an open source AI coding agent. Prior to 1.0.216, OpenCode automatically starts an unauthenticated HTTP server that allows any local process (or any website via permissive CORS) to execute arbitrary shell commands with the user's privileges. This vulnerability is fixed in 1.0.216.

Affected products and versions

Product Affected versions Fixed in
opencode 1.0 earliest → < 1.0.216 1.0.216

Other CVEs of opencode

The 3 CVEs of opencode →
CVE-2026-119025 open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code… 7.7 High CVE-2026-22813 OpenCode is an open source AI coding agent 9.4 Critical
Track this CVE