OpenCode localhost web UI XSS leading to local command execution
CVE-2026-22813 is a cross-site scripting vulnerability in OpenCode, an open source AI coding agent. The OpenCode web interface renders LLM/chat markdown responses and inserts arbitrary HTML into the DOM without sanitization, and the interface also lacks a Content Security Policy sufficient to prevent script execution. As described in the provided content, an attacker who can control an LLM response in a chat session, including via the web UI's server URL override feature, can inject malicious HTML/JavaScript that executes in the security context of the OpenCode web UI origin at http://localhost:4096. Because that origin has access to the local OpenCode API, the XSS can be used to issue requests to sensitive localhost endpoints and bridge from browser script execution to local system command execution. The issue is reported fixed in OpenCode 1.1.10.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
Remediation
Patch, then assume compromise.
Exploits
No valid public exploits. Mallory filtered out 1 candidate as fakes, detection scripts, or README-only repos.
All candidate exploits were filtered out by Mallory's validation.
Affected products & vendors
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
Recent activity
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical XSS-to-localhost Remote Code Execution chain in the OpenCode agent web UI that allows a malicious website to inject JavaScript and then call the local OpenCode API on localhost to spawn arbitrary processes on the developer workstation.
A critical HTML injection / XSS issue in OpenCode’s web UI markdown rendering of LLM responses that allows arbitrary JavaScript execution in the localhost web UI origin, enabling command execution on the local system via the UI context.
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.