CVE-2026-22812 OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution
An unauthenticated local HTTP server in OpenCode allows arbitrary shell command execution via permissive CORS, requiring an upgrade to secure the tool.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-22812?
CVE-2026-22812 is a high-severity command injection vulnerability in anomalyco opencode, published on 12 Jan 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
OpenCode is an open source AI coding agent. Prior to 1.0.216, OpenCode automatically starts an unauthenticated HTTP server that allows any local process (or any website via permissive CORS) to execute arbitrary shell commands with the user's privileges. This vulnerability is fixed in 1.0.216.
Which versions are affected by CVE-2026-22812?
2 open source packages ship an affected version, including opencode-ai. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
opencode-ai npm | All versions | 1.0.216 |
opencode-ai npm | All versions | 1.0.216 |
Products include Anoma Opencode.
How do I fix CVE-2026-22812?
Upgrade opencode-ai to 1.0.216 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-22812 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-22812 exists.
Public exploit code: 1 Nuclei template and 9 proofs of concept on GitHub.
Other vulnerabilities in anomalyco opencode
Sources
Also known as GHSA-vxw4-wv6m-9hhh.