# CVE-2026-22813: OpenCode web UI cross-site scripting leading to arbitrary command execution

Source: https://junglewise.ai/threats/cve-2026-22813-opencode-web-ui-cross-site-scripting-leading-to-arbitrary-command  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-22813 · Severity: medium · CVSS 4 · Published 2026-01-13

OpenCode is a local development tool that automatically starts an HTTP server on the user's machine to provide a web interface and API for code development. A malicious website can trick a user into visiting a specially crafted link that injects JavaScript into the OpenCode web UI, which then executes arbitrary commands on the user's local system with the same privileges as the user running OpenCode. This could allow an attacker to steal source code, install backdoors, or compromise sensitive development environments.

Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-22813 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-22813 being exploited in the wild.

**How severe is CVE-2026-22813?** Medium severity, with a CVSS score of 4, published 13 January 2026.

**Which products and versions are affected?** Anomaly OpenCode <1.1.10; opencode-ai (npm) SEMVER:introduced=0,fixed=1.1.10.

**Is there a fix for CVE-2026-22813?** Yes. opencode-ai (npm): upgrade to 1.1.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-22813 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-22813?** Check whether you run Anomaly OpenCode or opencode-ai (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- opencode-ai (npm): upgrade to 1.1.10 or later

  ```sh
  npm install opencode-ai@1.1.10
  ```


## Technical details

OpenCode suffers from a stored cross-site scripting (XSS) vulnerability combined with an insecure server URL override feature and unprotected API endpoints. The vulnerability chain works as follows: (1) The OpenCode web UI accepts a ?url= parameter to load chat sessions from a custom server location, (2) the markdown renderer that displays LLM responses does not sanitize HTML input or enforce content security policy, allowing arbitrary HTML/JavaScript injection, (3) an attacker can craft a malicious URL directing a user to http://localhost:4096/?url=attacker.com, which loads a chat session containing JavaScript payload embedded in an image onerror handler, (4) this JavaScript executes in the localhost:4096 origin, (5) JavaScript can then make same-origin requests to the /pty/ API endpoints to spawn arbitrary processes on the local machine. User interaction is required (clicking a malicious link). The OpenCode team mitigated the specific ?url= bypass on the server-side as of January 9, 2026, but the underlying XSS and unprotected API remain exploitable via other XSS vectors. Users should upgrade to version 1.1.10 or later.

## Affected products

- Anomaly OpenCode <1.1.10

## Identifiers

- CVE-2026-22813
- GHSA-c83v-7274-4vgp

## Timeline

- 2026-01-13: disclosed
- 2026-01-09: patched: Server-side mitigation for ?url= parameter bypass deployed
- 2026-01-13: advisory: GHSA-c83v-7274-4vgp published

## References

- [https://github.com/anomalyco/opencode/security/advisories/GHSA-c83v-7274-4vgp](https://github.com/anomalyco/opencode/security/advisories/GHSA-c83v-7274-4vgp)

## Related threats

- [OpenCode unauthenticated HTTP server remote code execution](https://junglewise.ai/threats/cve-2026-22812-opencode-unauthenticated-http-server-remote-code-execution)