https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 23:05:07 +0000 https://vulnerability.circl.lu/vuln/cve-2026-22813 <p><strong>Affected:</strong> anomalyco opencode</p> <p>OpenCode is an open source AI coding agent. The markdown renderer used for LLM responses will insert arbitrary HTML into the DOM. There is no sanitization with DOMPurify or even a CSP on the web interface to prevent JavaScript execution via HTML injection. This means controlling the LLM response for a chat session gets JavaScript execution on the http://localhost:4096 origin. This vulnerability is fixed in 1.1.10.</p> <p><strong>Affected:</strong> anomalyco opencode</p> <p>OpenCode is an open source AI coding agent. The markdown renderer used for LLM responses will insert arbitrary HTML into the DOM. There is no sanitization with DOMPurify or even a CSP on the web interface to prevent JavaScript execution via HTML injection. This means controlling the LLM response for a chat session gets JavaScript execution on the http://localhost:4096 origin. This vulnerability is fixed in 1.1.10.</p> https://vulnerability.circl.lu/vuln/cve-2026-22813 https://vulnerability.circl.lu/vuln/ghsa-c83v-7274-4vgp <p><strong>Affected:</strong> npm: opencode-ai</p> <p>### Summary A malicious website can abuse the server URL override feature of the OpenCode web UI to achieve cross-site scripting on `http://localhost:4096`. From there, it is possible to run arbitrary commands on the local system using the `/pty/` endpoints provided by the OpenCode API.</p> <p>### Code execution via OpenCode API</p> <p>- The OpenCode API has `/pty/` endpoints that allow spawning arbitrary processes on the local machine. - When you run `opencode` in your terminal, OpenCode automatically starts an HTTP server on `localhost:4096` that exposes the API along with a web interface. - JavaScript can make arbitrary same-origin `fetch()` requests to the `/pty/` API endpoints. Therefore, JavaScript execution on `http://localhost:4096` gets you code execution on local the machine.</p> <p>### JavaScript execution on localhost:4096</p> <p>The markdown renderer used for LLM responses will insert arbitrary HTML into the DOM. There is no sanitization with DOMPurify or even a CSP on the web interface to prevent JavaScript execution via HTML injection.</p> <p>This means controlling the LLM response for a chat session gets you JavaScript execution on the `http://localhost:4096` origin. This alone would not be enough for a 1-click exploit, but there&#39;s functionality in `packages/app/src/app.tsx` to allow specifying a custom server URL in a `?url=...` parameter:</p> <p>```javascript // packages/app/src/app.tsx const defaultServerUrl = iife(() =&gt; { const param = new URLSearchParams(document.location.search).get(…</p> <p><strong>Affected:</strong> npm: opencode-ai</p> <p>### Summary A malicious website can abuse the server URL override feature of the OpenCode web UI to achieve cross-site scripting on `http://localhost:4096`. From there, it is possible to run arbitrary commands on the local system using the `/pty/` endpoints provided by the OpenCode API.</p> <p>### Code execution via OpenCode API</p> <p>- The OpenCode API has `/pty/` endpoints that allow spawning arbitrary processes on the local machine. - When you run `opencode` in your terminal, OpenCode automatically starts an HTTP server on `localhost:4096` that exposes the API along with a web interface. - JavaScript can make arbitrary same-origin `fetch()` requests to the `/pty/` API endpoints. Therefore, JavaScript execution on `http://localhost:4096` gets you code execution on local the machine.</p> <p>### JavaScript execution on localhost:4096</p> <p>The markdown renderer used for LLM responses will insert arbitrary HTML into the DOM. There is no sanitization with DOMPurify or even a CSP on the web interface to prevent JavaScript execution via HTML injection.</p> <p>This means controlling the LLM response for a chat session gets you JavaScript execution on the `http://localhost:4096` origin. This alone would not be enough for a 1-click exploit, but there&#39;s functionality in `packages/app/src/app.tsx` to allow specifying a custom server URL in a `?url=...` parameter:</p> <p>```javascript // packages/app/src/app.tsx const defaultServerUrl = iife(() =&gt; { const param = new URLSearchParams(document.location.search).get(…</p> https://vulnerability.circl.lu/vuln/ghsa-c83v-7274-4vgp