CVE-2026-22813
HTML Injection in OpenCode Markdown Renderer Enables JavaScript Execution
Publication date: 2026-01-12
Last updated on: 2026-01-12
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Affected Vendors & Products
| Vendor | Product | Version |
|---|---|---|
| anomalyco | opencode | to 1.1.10 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-22813 is a critical remote code execution vulnerability in the OpenCode web UI. The markdown renderer used for LLM responses inserts arbitrary HTML into the DOM without sanitization or Content Security Policy, allowing an attacker to inject malicious JavaScript (XSS). Because OpenCode runs an HTTP server on localhost:4096 with API endpoints that can spawn arbitrary processes, JavaScript executing on this origin can execute commands on the local machine. Attackers can exploit this by tricking users into opening crafted URLs that load attacker-controlled chat sessions, injecting malicious HTML that triggers JavaScript execution and command spawning on the victim's system. This vulnerability was fixed in version 1.1.10 by disabling the URL override feature and the vulnerable API endpoints. [1]
How can this vulnerability impact me? :
This vulnerability can allow an attacker to execute arbitrary commands on your local machine without any privileges or user interaction beyond visiting a malicious URL. This can lead to full compromise of your system, including creating or modifying files, launching applications, or other malicious activities. The impact is high on confidentiality, integrity, and availability of your system and data. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking if your system is running OpenCode web UI versions prior to 1.1.10, especially if the HTTP server is active on localhost port 4096. To detect potential exploitation, monitor for unusual HTTP requests to http://localhost:4096, particularly those involving the /pty/ API endpoints. You can use commands like `netstat -tulnp | grep 4096` to check if the OpenCode server is running, and `curl http://localhost:4096/pty/` to see if the API endpoints respond. Additionally, inspecting browser developer tools for injected HTML or JavaScript in the OpenCode web UI may help identify exploitation attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade OpenCode to version 1.1.10 or later, which disables the vulnerable URL override feature and the web UI/OpenCode API to reduce the attack surface. Until you can upgrade, avoid visiting untrusted URLs that load chat sessions via the ?url= parameter on the OpenCode web UI. Also, consider restricting access to localhost:4096 to prevent unauthorized JavaScript execution and API access. [1]