{"data":{"id":"75f48ec1-0106-45e7-a627-11cc1196f378","title":"CVE-2026-22813: OpenCode is an open source AI coding agent. The markdown renderer used for LLM responses will insert arbitrary HTML…","summary":"CVE-2026-22813 affects OpenCode, an open source AI coding agent. The markdown renderer for LLM responses inserts arbitrary HTML into the DOM without DOMPurify sanitization or a CSP on the web interface, so controlling a chat session's LLM response yields JavaScript execution on the http://localhost:4096 origin. GitHub, Inc. assigned a CVSS 4.0 base score of 9.4 (CRITICAL), while NIST has not yet provided an assessment.","solution":"Fixed in 1.1.10","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-22813","publishedAt":"2026-01-12T23:15:53.523Z","cveId":"CVE-2026-22813","cweIds":["CWE-79"],"cvssScore":"6.1","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["opencode-ai@< 1.1.10 (fixed: 1.1.10)"],"affectedPackageNames":["opencode-ai"],"affectedPackageRefs":["npm:opencode-ai"],"affectedVendors":[],"affectedVendorsRaw":["OpenCode"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"OpenCode markdown renderer allows HTML injection leading to script execution","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00905,"epssCheckedAt":"2026-11-05T06:10:14.984Z","kevDateAdded":null,"advisoryAliases":["GHSA-c83v-7274-4vgp"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:51:23.926Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2026-01-09T21:37:04.266Z","daysToFix":-3,"fixCheckedAt":"2026-10-29T21:42:07.406Z","capecIds":["CAPEC-198","CAPEC-86"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"opencode-ai","fixedVersion":"1.1.10","matchedVersion":"1.1.10","fixReleasedAt":"2026-01-09T21:37:04.266Z","daysToFix":-3,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:42:07.254Z"}]}}