OpenCode AI Coding Agent RCE via Unauthenticated Local Server and Web UI XSS

Security researchers disclosed two high-severity vulnerabilities in the open-source OpenCode AI coding agent that can allow arbitrary command execution on a developer workstation in drive-by scenarios. CVE-2026-22812 stems from OpenCode automatically starting an unauthenticated HTTP server with permissive CORS (Access-Control-Allow-Origin: *), enabling any local process—or a malicious website via cross-origin requests—to invoke sensitive local API endpoints and execute shell commands with the user’s privileges. Separately, CVE-2026-22813 is a critical issue in the OpenCode web UI where the markdown renderer can inject arbitrary HTML into the DOM without sanitization (no DOMPurify and no CSP), enabling JavaScript execution on the http://localhost:4096 origin and subsequent access to local APIs that can spawn processes.

Mitigations are available for both OpenCode issues: CVE-2026-22812 is fixed in OpenCode 1.0.216, and CVE-2026-22813 is fixed in OpenCode 1.1.10. Other items in the set describe unrelated vulnerabilities in different products (e.g., a command-injection flaw in an end-of-life VS Code extension, unsafe deserialization in LlamaIndex, ReDoS in LangChain, and various web app SQLi/XSS/access-control issues) and do not materially change the OpenCode risk picture; they should be tracked separately by affected-asset ownership and exposure.