Critical OpenCode Flaws Let Websites Hijack Your PC

Two vulnerabilities were found in the open-source OpenCode agent that let attackers write malicious code directly onto your machine. Security researchers have disclosed two high-severity flaws that turn the popular AI tool into a gateway for Remote Code Execution (RCE), potentially allowing malicious websites to hijack a developer’s workstation simply by visiting a webpage.

The vulnerabilities, tracked as CVE-2026-22813 and CVE-2026-22812, stem from insecure defaults in how the application handles its local web server and user interface.

The most critical of the pair is CVE-2026-22813, earning a critical CVSS score of 9.4. This vulnerability leverages a Cross-Site Scripting (XSS) flaw to bridge the gap between the web and the local system.

According to the advisory, a malicious website can abuse the “server URL override feature” in the OpenCode web UI. Because the application fails to sanitize HTML input—specifically lacking “DOMPurify or even a CSP”—an attacker can inject malicious scripts into the chat interface.

Once the script is running, it can make requests to the local OpenCode API (hosted on localhost:4096), accessing endpoints that allow it to spawn arbitrary processes. “JavaScript execution on http://localhost:4096 gets you code execution on the local machine”.

CVE-2026-22812 (CVSS 8.8) reveals OpenCode’s backend was essentially wide open. The application automatically starts an HTTP server that lacks any authentication middleware.

Even worse, the server is configured with “permissive CORS,” meaning it will accept requests from any origin (Access-Control-Allow-Origin: *) . This creates a massive security hole where “any website can execute commands on visitors who have OpenCode running” via a drive-by attack.

The critical endpoints exposed include:

• POST /session/:id/shell: Execute shell commands.
• GET /file/content?path=: Read arbitrary files from the disk.

The vulnerabilities affect OpenCode versions prior to 1.0.216. The developers have released a patch in version 1.0.216 (and likely later) to address these issues. Users are strongly advised to update their installations immediately to close these dangerous avenues for exploitation.

Related Posts:

• JavaScript Drive-By Attacks: New Exploits without 0-Day in Google Chrome
• India plans to require e-commerce, social media companies such as Google Facebook to store data locally
• Beware of Search Results: Hackers Using Fake Websites to Spread Malware
• WordPress Issues Urgent Security Update to Patch Multiple Vulnerabilities
• Linux Kernel Vulnerability Exposes Local Systems to Privilege Escalation, PoC Published