CyberSecBulletin

Anomalyco vulnerabilities

We track 2 vulnerabilities in Anomalyco products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on October 29, 2026.

2vulnerabilities
0critical
2high
0exploited
8.2average CVSS score

Latest Anomalyco vulnerabilities

  • 7.5 High severity

    open: Improper Neutralization of Special Elements used in an OS Command

    CVE-2026-119025SindresorhusEPSS 1.45%

    open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL. Attackers can embed $(...) subexpressions in URLs, such as OAuth authorization_endpoint value

  • 8.8 High severity

    opencode: Missing Authentication for Critical Functionality

    CVE-2026-22812AnomalycoEPSS 16.5%

    OpenCode is an open source AI coding agent. Prior to 1.0.216, OpenCode automatically starts an unauthenticated HTTP server that allows any local process (or any website via permissive CORS) to execute arbitrary shell commands with the user's privileges. This v