🔐 CVE-2026-22812 - OpenCode Unauthenticated HTTP Server → Remote Code Execution (RCE)

---

Security advisory, technical analysis, detection guidance, and mitigation notes for CVE-2026-22812

📌 Overview

CVE-2026-22812 is a high-severity Remote Code Execution (RCE) vulnerability affecting OpenCode versions prior to 1.0.216.

The issue exists because OpenCode automatically starts an unauthenticated local HTTP server that can be accessed by:

• local malicious processes
• browser tabs through permissive CORS
• injected web content
• localhost cross-origin requests

This allows attackers to execute arbitrary shell commands with the privileges of the current user

🚨 Severity

Source: NVD / GitHub Advisory

🧠 Technical Root Cause

The vulnerable versions automatically expose a localhost HTTP service without authentication.

Because the service also accepts requests from permissive cross-origin sources, any malicious webpage can trigger requests such as:

POST /session/:id/shell

This can lead to:

• arbitrary command execution
• credential theft
• source code exfiltration
• SSH key exposure
• cloud token compromise
• local persistence

💥 Impact

Successful exploitation may result in:

• 🔓 Full developer workstation compromise
• 🗝️ Secret leakage (.env, SSH, API tokens)
• 📂 Unauthorized source code access
• ☁️ Cloud CLI session hijacking
• 🧪 Supply-chain compromise risks
• 🖥️ Arbitrary shell execution as logged-in user

📸 Screenshot

📦 Affected Versions

Vulnerable: < 1.0.216
Safe:       >= 1.0.216

🛠️ Mitigation

✅ Recommended Fix

Upgrade immediately:

npm update opencode

or install a safe version:

npm install [email protected]

🧱 Temporary Workarounds

If upgrading is not immediately possible:

• restrict localhost port access
• isolate OpenCode inside a container
• block suspicious localhost requests
• close untrusted browser tabs
• rotate exposed credentials
• disable permissive CORS if configurable

🔍 Detection Tips

Indicators of possible exploitation:

• unusual shell commands spawned by OpenCode
• suspicious localhost POST requests
• browser-originated requests to OpenCode ports
• unexpected file access in project directories
• abnormal terminal child processes

Recommended telemetry:

• EDR process tree monitoring
• localhost HTTP access logs
• shell execution auditing
• browser security telemetry

🧪 Proof of Concept Status

⚠️ Public exploitation details exist in advisory discussions.

For responsible disclosure and safety, avoid publishing weaponized PoCs in public production repositories.

📚 References

• NVD Advisory NVD CVE Entry
• OSV Database OSV Entry
• Vendor Advisory GitHub Security Advisory

⚖️ Disclaimer

This repository is intended for:

• defensive security research
• blue-team awareness
• patch validation
• vulnerability management
• secure development education

Do not use this information on systems you do not own or have permission to test.