CVE-2026-22813 - Malicious website can execute commands on the local system through XSS in the Op

CVE ID : CVE-2026-22813 Published : Jan. 12, 2026, 11:15 p.m. | 1 hour, 35 minutes ago Description : OpenCode is an open source AI coding agent. The markdown renderer used for LLM responses will insert arbitrary HTML into the DOM. There is no sanitization with DOMPurify or even a CSP on the web interface to prevent JavaScript execution via HTML injection. This means controlling the LLM response for a chat session gets JavaScript execution on the http://localhost:4096 origin. This vulnerability is fixed in 1.1.10. Severity: 9.4 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Source: Telegram CVE Monitor