CVE-2026-22812: 
JavaScript vulnerability analysis and mitigation

CVE-2026-22812 is a critical remote code execution vulnerability in OpenCode, an open-source AI coding agent, caused by an unauthenticated HTTP server that exposes dangerous shell execution endpoints. Affecting all versions of the opencode-ai npm package prior to 1.0.216, the flaw allows any local process or any website (via permissive CORS) to execute arbitrary shell commands with the privileges of the user running OpenCode. The vulnerability was originally reported to support@sst.dev on 2025-11-17 and publicly disclosed on January 12, 2026, after no vendor response was received. It carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, OpenCode Advisory).

The root cause is a combination of CWE-306 (Missing Authentication for Critical Function), CWE-749 (Exposed Dangerous Method or Function), and CWE-942 (Permissive Cross-domain Policy with Untrusted Domains). When OpenCode starts, it automatically spawns an HTTP server on port 4096+ (via Server.listen() in cli/cmd/tui/worker.ts:36) with no authentication middleware in server/server.ts. Three critical unauthenticated endpoints are exposed: POST /session/:id/shell (execute shell commands), POST /pty (create interactive terminal sessions), and GET /file/content?path= (read arbitrary files). The server is configured with wildcard CORS (Access-Control-Allow-Origin: *), enabling browser-based cross-origin exploitation; when the --mdns flag is used, the server binds to 0.0.0.0 and advertises via Bonjour/mDNS, extending the attack surface to the entire local network (GitHub Advisory).

Successful exploitation results in full remote code execution with the privileges of the user running OpenCode, enabling high confidentiality, integrity, and availability impacts. Attackers can read arbitrary files via the /file/content endpoint, execute arbitrary shell commands via /session/:id/shell, and establish interactive terminal sessions via /pty. Attack scenarios include drive-by exploitation through malicious websites or ads (confirmed working in Firefox), supply-chain attacks via malicious npm packages, and — when --mdns is enabled — lateral movement to any device on the local network (GitHub Advisory, Feedly).

Multiple public proof-of-concept exploits are available, including repositories on GitHub (e.g., rohmatariow/CVE-2026-22812-exploit, Udyz/CVE-2026-22812-Exp, Ashwesker/Ashwesker-CVE-2026-22812, mad12wader/CVE-2026-22812, 0xBlackash/CVE-2026-22812). The vulnerability requires no authentication and no special privileges; browser-based exploitation requires only that a victim visit a malicious website while OpenCode is running. The EPSS score is approximately 4.765% (90th percentile per GitHub Advisory) or 0.101% per Feedly's estimate. Nuclei detection templates have been added to ProjectDiscovery's nuclei-templates repository. No confirmed in-the-wild exploitation or CISA KEV listing has been reported as of the available data (GitHub Advisory, OpenCode Advisory).

1. Reconnaissance: Identify systems running OpenCode (versions < 1.0.216) by scanning for open ports in the 4096+ range on localhost or, if --mdns is enabled, on the local network via Bonjour/mDNS service discovery.
2. Discover the active port: Probe http://127.0.0.1:4096 (and incrementing ports) with a simple HTTP GET or POST to confirm OpenCode's server is listening.
3. Create a session (local process vector): Send an unauthenticated POST request to create a session:

   SESSION_ID=$(curl -s -X POST "http://127.0.0.1:4096/session" -H "Content-Type: application/json" -d '{}' | jq -r '.id')

4. Execute arbitrary shell commands: POST to the shell endpoint with the session ID:

   curl -s -X POST "http://127.0.0.1:4096/session/$SESSION_ID/shell" \
     -H "Content-Type: application/json" \
     -d '{"agent": "build", "command": "id > /tmp/pwned.txt"}'

5. Browser-based (drive-by) vector: Host a malicious webpage with JavaScript that fetches http://127.0.0.1:4096/session (POST), extracts the session ID, then POSTs a command to /session/{id}/shell. This works in Firefox without any permission prompts; Chrome 142+ may prompt for Local Network Access.
6. Read arbitrary files: Use GET http://127.0.0.1:4096/file/content?path=/etc/passwd (or any sensitive path) to exfiltrate data without authentication.
7. Escalate/persist: Use the shell execution capability to install backdoors, exfiltrate credentials, or pivot to other systems on the network (GitHub Advisory, OpenCode Advisory).

• Network: Unexpected HTTP POST requests to http://127.0.0.1:4096/session, /session/<id>/shell, or /pty from processes other than OpenCode itself; outbound connections from the OpenCode process to unknown external IPs; mDNS/Bonjour service advertisements for OpenCode on the local network when --mdns is not intentionally configured.
• File System: Unexpected files created in /tmp/ (e.g., pwned.txt) or other world-writable directories; new cron jobs, startup scripts, or SSH authorized keys added by the OpenCode process user; web shells or backdoor binaries dropped in user-accessible directories.
• Logs: HTTP server access logs (if enabled) showing requests to /session, /session/:id/shell, /pty, or /file/content from unexpected sources; shell history entries showing commands executed via the OpenCode API.
• Process: Unusual child processes spawned by the OpenCode Node.js process (e.g., bash, sh, curl, wget, python, nc); unexpected network listeners on ports 4096+ bound to 0.0.0.0 instead of 127.0.0.1 (GitHub Advisory).

The vulnerability is fixed in OpenCode version 1.0.216; users should upgrade the opencode-ai npm package immediately (npm install -g opencode-ai@latest). As an interim workaround, disable the --mdns flag if enabled to prevent the server from binding to 0.0.0.0 and advertising on the local network. Users should also consider using host-based firewall rules to block external access to port 4096+ until the upgrade is applied. Avoid running OpenCode while browsing untrusted websites, particularly in Firefox, which does not prompt for Local Network Access permissions (GitHub Advisory, OpenCode Advisory).

The vulnerability received notable attention given OpenCode's large user base (173k GitHub stars). Security researchers highlighted the risk of AI coding tools becoming attack surfaces, with coverage from The Hacker Wire, SecurityOnline, and Cyble's weekly vulnerability digest. A Medium post by researcher @dhxrxx titled "How I Got RCE on a 71k-Star AI Coding Tool with Zero Authentication" provided a detailed write-up. Community discussion appeared on Hacker News, Bluesky, and Mastodon/Infosec.Exchange, with DarkWebInformer amplifying the disclosure. Check Point Research also published an advisory (CPAI-2026-1314). The Kaspersky Securelist Q1 2026 vulnerability roundup included this CVE as a notable finding (The Hacker Wire, SecurityOnline, Securelist).