opencode vulnerabilities

2 known vulnerabilities in opencode from Anomalyco. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  open: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-119025Oct 29, 2026SindresorhusEPSS 1.45%

  open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL. Attackers can embed $(...) subexpressions in URLs, such as OAuth authorization_endpoint value

• 8.8 High severity

  opencode: Missing Authentication for Critical Functionality

  CVE-2026-22812Jan 12, 2026AnomalycoEPSS 16.5%

  OpenCode is an open source AI coding agent. Prior to 1.0.216, OpenCode automatically starts an unauthenticated HTTP server that allows any local process (or any website via permissive CORS) to execute arbitrary shell commands with the user's privileges. This v