opencode-ai vulnerabilities (npm)

2 vulnerabilities.

• opencode-ai npm Malicious website can execute commands on the local system through XSS in the OpenCode web UI CVE-2026-22813 Fix available 9.4 CriticalJanuary 12, 2026
• opencode-ai npm OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution CVE-2026-22812 Public exploitFix available EPSS 16.5% 8.8 HighJanuary 12, 2026