{"data":{"id":"ca0648b6-19d6-4522-a8d5-3af7b3131320","title":"CVE-2026-22812: OpenCode is an open source AI coding agent. Prior to 1.0.216, OpenCode automatically starts an unauthenticated HTTP…","summary":"CVE-2026-22812 affects OpenCode, an open source AI coding agent, before version 1.0.216. OpenCode automatically starts an unauthenticated HTTP server, which lets any local process, or any website through permissive CORS, run arbitrary shell commands with the user's privileges. The weakness is classified as CWE-306, CWE-749 and CWE-942.","solution":"Fixed in 1.0.216.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-22812","publishedAt":"2026-01-12T23:15:53.370Z","cveId":"CVE-2026-22812","cweIds":["CWE-306","CWE-749","CWE-942"],"cvssScore":"8.8","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["opencode-ai@< 1.0.216 (fixed: 1.0.216)"],"affectedPackageNames":["opencode-ai"],"affectedPackageRefs":["npm:opencode-ai"],"affectedVendors":[],"affectedVendorsRaw":["OpenCode"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"OpenCode unauthenticated HTTP server allows arbitrary shell command execution","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.16538,"epssCheckedAt":"2026-11-04T18:09:13.251Z","kevDateAdded":null,"advisoryAliases":["GHSA-vxw4-wv6m-9hhh"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:51:24.440Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2025-12-30T18:06:37.032Z","daysToFix":-13,"fixCheckedAt":"2026-10-29T21:42:08.223Z","capecIds":["CAPEC-115"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"opencode-ai","fixedVersion":"1.0.216","matchedVersion":"1.0.216","fixReleasedAt":"2025-12-30T18:06:37.032Z","daysToFix":-13,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:42:08.074Z"}]}}