# CVE-2026-22812

## Summary

- **CVE ID:** CVE-2026-22812
- **Severity:** HIGH
- **CVSS Score:** 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
- **CWE:** CWE-306, CWE-749, CWE-942
- **Published:** Jan 12, 2026
- **Last Modified:** Mar 12, 2026

## Description

OpenCode is an open source AI coding agent. Prior to 1.0.216, OpenCode automatically starts an unauthenticated HTTP server that allows any local process (or any website via permissive CORS) to execute arbitrary shell commands with the user's privileges. This vulnerability is fixed in 1.0.216.

## Affected Products

- anomalyco — opencode (< 1.0.216)

## References

- [CNA](https://github.com/anomalyco/opencode/security/advisories/GHSA-vxw4-wv6m-9hhh)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 16.77%
- **EPSS Percentile:** 96.8

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-10._