CVE-2026-22813

MEDIUM

6.1

Descricao

OpenCode is an open source AI coding agent. The markdown renderer used for LLM responses will insert arbitrary HTML into the DOM. There is no sanitization with DOMPurify or even a CSP on the web interface to prevent JavaScript execution via HTML injection. This means controlling the LLM response for a chat session gets JavaScript execution on the http://localhost:4096 origin. This vulnerability is fixed in 1.1.10.

Detalhes CVE

Pontuacao CVSS v3.16.1

SeveridadeMEDIUM

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosNONE

Interacao do usuarioREQUIRED

Publicado1/12/2026

Ultima modificacao1/21/2026

Fontenvd

Avistamentos honeypot0

Produtos afetados

anoma:opencode

Fraquezas (CWE)

CWE-79

Referencias

https://github.com/anomalyco/opencode/security/advisories/GHSA-c83v-7274-4vgp(security-advisories@github.com)

https://github.com/anomalyco/opencode/security/advisories/GHSA-c83v-7274-4vgp(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.