Executive brief
OpenCode is a local development tool that automatically starts an HTTP server on the user's machine to provide a web interface and API for code development. A malicious website can trick a user into visiting a specially crafted link that injects JavaScript into the OpenCode web UI, which then executes arbitrary commands on the user's local system with the same privileges as the user running OpenCode. This could allow an attacker to steal source code, install backdoors, or compromise sensitive development environments.
Technical details
OpenCode suffers from a stored cross-site scripting (XSS) vulnerability combined with an insecure server URL override feature and unprotected API endpoints. The vulnerability chain works as follows: (1) The OpenCode web UI accepts a ?url= parameter to load chat sessions from a custom server location, (2) the markdown renderer that displays LLM responses does not sanitize HTML input or enforce content security policy, allowing arbitrary HTML/JavaScript injection, (3) an attacker can craft a malicious URL directing a user to http://localhost:4096/?url=attacker.com, which loads a chat session containing JavaScript payload embedded in an image onerror handler, (4) this JavaScript executes in the localhost:4096 origin, (5) JavaScript can then make same-origin requests to the /pty/ API endpoints to spawn arbitrary processes on the local machine. User interaction is required (clicking a malicious link). The OpenCode team mitigated the specific ?url= bypass on the server-side as of January 9, 2026, but the underlying XSS and unprotected API remain exploitable via other XSS vectors. Users should upgrade to version 1.1.10 or later.
Affected products
- Anomaly OpenCode <1.1.10
Timeline
- 2026-01-13: disclosed
- 2026-01-09: patched: Server-side mitigation for ?url= parameter bypass deployed
- 2026-01-13: advisory: GHSA-c83v-7274-4vgp published