CRITICALnpm
GHSA-c83v-7274-4vgp· CVE-2026-22813Malicious website can execute commands on the local system through XSS in the OpenCode web UI
Modified: 2/3/2026
package
pkg:npm/opencode-ai
Malicious website can execute commands on the local system through XSS in the OpenCode web UI
Modified: 2/3/2026
OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution
Modified: 2/3/2026