CVE-2026-22813 Malicious website can execute commands on the local system through XSS in the OpenCode web UI
Attackers can execute arbitrary commands on the local system via XSS in the OpenCode web UI by controlling LLM responses.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-22813?
CVE-2026-22813 is a critical cross-site scripting vulnerability in anomalyco opencode, published on 12 Jan 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
OpenCode is an open source AI coding agent. The markdown renderer used for LLM responses will insert arbitrary HTML into the DOM. There is no sanitization with DOMPurify or even a CSP on the web interface to prevent JavaScript execution via HTML injection. This means controlling the LLM response for a chat session gets JavaScript execution on the http://localhost:4096 origin. This vulnerability is fixed in 1.1.10.
Weakness: CWE-79
Which versions are affected by CVE-2026-22813?
2 open source packages ship an affected version, including opencode-ai. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
opencode-ai npm | All versions | 1.1.10 |
opencode-ai npm | All versions | 1.1.10 |
Products include Anoma Opencode.
How do I fix CVE-2026-22813?
Upgrade opencode-ai to 1.1.10 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-22813 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-22813 exists.
Other vulnerabilities in anomalyco opencode
Sources
Also known as GHSA-c83v-7274-4vgp.