CLAIM-2026-09-29-11

CVE-2026-22812 and CVE-2026-22813 are distinct, earlier OpenCode vulnerabilities - an unauthenticated HTTP server allowing arbitrary command execution, and command execution via XSS in the OpenCode web UI - with GitHub advisories GHSA-vxw4-wv6m-9hhh and GHSA-c83v-7274-4vgp published on 12 January 2026, the XSS issue affecting releases before 1.1.10.

Why it matters

Checking a version against the wrong identifier is how a patched team concludes it is exposed, or the reverse. Verify the identifier, not the topic.

Sources

• githubsecur2026crosssite