Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:npm/opencode-ai@1.1.10
purl pkg:npm/opencode-ai@1.1.10
Vulnerabilities affecting this package (0)
Vulnerability Summary Fixed by
This package is not known to be affected by vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-hzxt-kugv-73fy Malicious website can execute commands on the local system through XSS in the OpenCode web UI A malicious website can abuse the server URL override feature of the OpenCode web UI to achieve cross-site scripting on `http://localhost:4096`. From there, it is possible to run arbitrary commands on the local system using the `/pty/` endpoints provided by the OpenCode API. CVE-2026-22813
GHSA-c83v-7274-4vgp

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-05T21:56:19.249675+00:00 GHSA Importer Fixing VCID-hzxt-kugv-73fy https://github.com/advisories/GHSA-c83v-7274-4vgp 38.6.0
2026-06-04T16:54:13.191773+00:00 GithubOSV Importer Fixing VCID-hzxt-kugv-73fy https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-c83v-7274-4vgp/GHSA-c83v-7274-4vgp.json 38.6.0
2026-06-02T04:49:29.419533+00:00 GitLab Importer Fixing VCID-hzxt-kugv-73fy https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/opencode-ai/CVE-2026-22813.yml 38.6.0