cve.bz

CVE-2026-22812

8.8 highEPSS 17%

High (8.8) in anoma opencode. EPSS 17% chance of exploitation in the next 30 days. Fixed in opencode-ai 1.0.216.

OpenCode is an open source AI coding agent. Prior to 1.0.216, OpenCode automatically starts an unauthenticated HTTP server that allows any local process (or any website via permissive CORS) to execute arbitrary shell commands with the user's privileges. This vulnerability is fixed in 1.0.216.

Severity

CVSS 3.1

8.8 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
17% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-31)
CWEs
CWE-306, CWE-749, CWE-942
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-vxw4-wv6m-9hhhnpmopencode-ai<1.0.2161.0.216

References

Check your stackJSON