Critical OpenCode Flaws Let Websites Hijack Your PC

Two high-severity vulnerabilities in the OpenCode agent (CVE-2026-22813, CVE-2026-22812) allow remote code execution: a stored XSS in the web UI can be used to call the local OpenCode API, and the built-in HTTP server runs without authentication and with permissive CORS exposing endpoints that execute shell commands and read files; affected versions are prior to 1.0.216 and a patch is available in 1.0.216 — users should update immediately.