{"action":"Upgrade opencode-ai to 1.0.216 or later.","affected":[{"fixed":"1.0.216","introduced":"0"}],"component":"opencode-ai","cve_ids":["CVE-2026-22812"],"ecosystem":"npm","epss":0.16538,"exploited":false,"fixed_versions":["1.0.216"],"ghsa_id":"GHSA-vxw4-wv6m-9hhh","id":"tcs_01M5KGDAQKG0JE1NFGE1VFA877","modified_at":"2026-02-03T03:00:05.488310Z","published_at":"2026-01-13T20:35:08Z","references":["https://osv.dev/vulnerability/GHSA-vxw4-wv6m-9hhh","https://github.com/anomalyco/opencode/security/advisories/GHSA-vxw4-wv6m-9hhh","https://nvd.nist.gov/vuln/detail/CVE-2026-22812","https://github.com/anomalyco/opencode/commit/7d2d87fa2c44e32314015980bb4e59a9386e858c","https://github.com/anomalyco/opencode"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-vxw4-wv6m-9hhh","url":"https://osv.dev/vulnerability/GHSA-vxw4-wv6m-9hhh"}],"summary":"OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution"}