Executive Summary

CVE-2026-22813 is a critical remote code execution vulnerability in the OpenCode web UI. The markdown renderer used for LLM responses inserts arbitrary HTML into the DOM without sanitization or Content Security Policy, allowing an attacker to inject malicious JavaScript (XSS). Because OpenCode runs an HTTP server on localhost:4096 with API endpoints that can spawn arbitrary processes, JavaScript executing on this origin can execute commands on the local machine. Attackers can exploit this by tricking users into opening crafted URLs that load attacker-controlled chat sessions, injecting malicious HTML that triggers JavaScript execution and command spawning on the victim's system. This vulnerability was fixed in version 1.1.10 by disabling the URL override feature and the vulnerable API endpoints. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to execute arbitrary commands on your local machine without any privileges or user interaction beyond visiting a malicious URL. This can lead to full compromise of your system, including creating or modifying files, launching applications, or other malicious activities. The impact is high on confidentiality, integrity, and availability of your system and data. [1]

Useful 0 Not Useful 0

Detection Guidance

You can detect this vulnerability by checking if your system is running OpenCode web UI versions prior to 1.1.10, especially if the HTTP server is active on localhost port 4096. To detect potential exploitation, monitor for unusual HTTP requests to http://localhost:4096, particularly those involving the /pty/ API endpoints. You can use commands like `netstat -tulnp | grep 4096` to check if the OpenCode server is running, and `curl http://localhost:4096/pty/` to see if the API endpoints respond. Additionally, inspecting browser developer tools for injected HTML or JavaScript in the OpenCode web UI may help identify exploitation attempts. [1]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade OpenCode to version 1.1.10 or later, which disables the vulnerable URL override feature and the web UI/OpenCode API to reduce the attack surface. Until you can upgrade, avoid visiting untrusted URLs that load chat sessions via the ?url= parameter on the OpenCode web UI. Also, consider restricting access to localhost:4096 to prevent unauthorized JavaScript execution and API access. [1]

Useful 0 Not Useful 0