CRITICALnpm
GHSA-c83v-7274-4vgp· CVE-2026-22813Malicious website can execute commands on the local system through XSS in the OpenCode web UI
Modified: 2/3/2026
package
npm/opencode-ai
pkg:npm/opencode-ai
HIGH8.8npm
GHSA-vxw4-wv6m-9hhh· CVE-2026-22812OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution
Modified: 2/3/2026