Malicious website kann Befehle auf dem lokalen System über XSS in der OpenCode Web-UI ausführen

The impact of CVE-2026-22813 is severe due to the potential for remote code execution. An attacker can craft a malicious website that, when visited by a user running OpenCode AI, exploits the XSS vulnerability to override the server URL. This allows the attacker to inject JavaScript code that can then access and abuse the /pty/ API endpoints. These endpoints enable the spawning of arbitrary processes on the local machine, effectively granting the attacker complete control over the system. This is akin to a remote shell, allowing for data theft, malware installation, and further lateral movement within the network.

Organizations utilizing OpenCode AI for local development or testing environments are particularly at risk, especially if the web UI is exposed to the internet or untrusted networks. Shared hosting environments where multiple users have access to the OpenCode instance are also vulnerable.

• nodejs / server: Monitor process execution for unexpected commands originating from the OpenCode AI process. Use ps aux | grep opencode to identify running instances and their associated commands. • generic web: Examine access logs for requests containing suspicious URL parameters attempting to override the server URL. Look for patterns like http://malicious.com?url=.... • generic web: Check response headers for signs of XSS payloads or unexpected behavior after submitting input to the server URL override feature. Use curl -I http://localhost:4096 to inspect headers.

1. 2026-01-13Disclosure

   disclosure

1. Reserviert2026-01-09
2. Veröffentlicht2026-01-13
3. Geändert2026-02-03
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-22813 is to immediately upgrade OpenCode AI to version 1.1.10 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) to filter requests containing malicious server URL overrides. Specifically, block requests containing suspicious URL parameters or patterns designed to exploit the override feature. Additionally, restrict access to the /pty/ API endpoints to trusted sources only. After upgrading, confirm the fix by attempting to access the web UI with a crafted URL designed to trigger the XSS vulnerability; it should no longer execute arbitrary commands.