CVE-2026-22812

PoC —

CVSS 3.1

8.8 high

EPSS

17%p97

Published

Jan 12, 2026 (Jan 12, 2026)

Modified

Jun 17, 2026

Description

OpenCode is an open source AI coding agent. Prior to 1.0.216, OpenCode automatically starts an unauthenticated HTTP server that allows any local process (or any website via permissive CORS) to execute arbitrary shell commands with the user's privileges. This vulnerability is fixed in 1.0.216.

Vendors: anoma
Products: opencode
Weakness: CWE-306, CWE-749, CWE-942
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (16.8%)

In the news0 stories

No ingested article mentions this CVE yet.