GHSA-vxw4-wv6m-9hhh
High · 8.8CVSS
8.8
EPSS
—
Published
Jan 13, 2026
CISA due date
—
The record
OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | opencode-ai | 0 | 1.0.216 |
Related vulnerabilities
- CVE-2026-22812 OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution Same vulnerability
- GHSA-c83v-7274-4vgp Malicious website can execute commands on the local system through XSS in the OpenCode… Also affects opencode-ai
- CVE-2026-22813 Malicious website can execute commands on the local system through XSS in the OpenCode… Also affects opencode-ai
- CVE-2026-114636 Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes… CWE-306
- CVE-2026-112104 A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. CWE-306
- CVE-2026-53714 Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or… CWE-306
- CVE-2026-89261 MoguBlog through 6.2 exposes Elasticsearch index management endpoints in the mogu_search… CWE-306
- CVE-2026-89250 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an… CWE-306