Skip to main content

Opencode

8 CVEs product

Monthly

CVE-2026-22812 Jan 12, 23:15 npm HIGH POC PATCH This Week

Opencode versions up to 1.0.216 is affected by missing authentication for critical function (CVSS 8.8).

Authentication Bypass RCE AI / ML Opencode
NVD GitHub
CVSS 3.1
8.8
EPSS
2.6%
CVE-2025-70614 Mar 05, 21:16 HIGH CISA Act Now

OpenCode Systems OC Messaging / USSD Gateway OC Release 6.32.2 contains a broken access control vulnerability in the web-based control panel allowing authenticated low-privileged attackers to gain to access to arbitrary SMS messages via a crafted company or tenant identifier parameter. [CVSS 8.1 HIGH]

Authentication Bypass Opencode Ussd Gateway
NVD GitHub
CVSS 3.1
8.1
EPSS
0.0%
CVE-2026-22813 Jan 12, 23:15 npm MEDIUM POC PATCH This Month

OpenCode's markdown renderer fails to sanitize HTML input in LLM responses, allowing attackers who control the chat output to inject arbitrary JavaScript that executes in the localhost:4096 origin without Content Security Policy protections. Public exploit code exists for this cross-site scripting vulnerability, affecting users of the AI coding agent through versions prior to 1.1.10. An attacker can achieve session compromise or local code execution by manipulating LLM responses to inject malicious scripts.

XSS AI / ML Opencode
NVD GitHub
CVSS 3.1
6.1
EPSS
0.0%
CVE-2025-65239 Nov 26, 17:15 MEDIUM POC This Month

Incorrect access control in the /aux1/ocussd/trace endpoint of OpenCode Systems USSD Gateway OC Release:5, version 6.13.11 allows attackers with low-level privileges to read server logs. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Authentication Bypass Opencode Ussd Gateway
NVD GitHub
CVSS 3.1
4.3
EPSS
0.0%
CVE-2025-65238 Nov 26, 17:15 MEDIUM POC This Month

Incorrect access control in the getSubUsersByProvider function of OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 allows attackers with low-level privileges to dump user records and. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Authentication Bypass Opencode Ussd Gateway
NVD GitHub
CVSS 3.1
6.5
EPSS
0.0%
CVE-2025-65237 Nov 26, 17:15 MEDIUM POC This Month

A reflected cross-site scripted (XSS) vulnerability in OpenCode Systems USSD Gateway OC Release: 5 allows attackers to execute arbitrary JavaScript in the context of a user's browser via injecting a. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

XSS Opencode Ussd Gateway
NVD GitHub
CVSS 3.1
6.1
EPSS
0.1%
CVE-2025-65236 Nov 26, 17:15 CRITICAL POC Act Now

OpenCode Systems USSD Gateway OC Release: 5 was discovered to contain a SQL injection vulnerability via the Session ID parameter in the /occontrolpanel/index.php endpoint. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

PHP SQLi Opencode Ussd Gateway
NVD GitHub
CVSS 3.1
9.8
EPSS
0.1%
CVE-2025-65235 Nov 26, 17:15 CRITICAL POC Act Now

OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 was discovered to contain a SQL injection vulnerability via the ID parameter in the getSubUsersByProvider function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

SQLi Opencode Ussd Gateway
NVD GitHub
CVSS 3.1
9.8
EPSS
0.1%
EPSS 3% CVSS 8.8
HIGH POC PATCH This Week

Opencode versions up to 1.0.216 is affected by missing authentication for critical function (CVSS 8.8).

Authentication Bypass RCE AI / ML +1
NVD GitHub
EPSS 0% CVSS 8.1
HIGH Act Now

OpenCode Systems OC Messaging / USSD Gateway OC Release 6.32.2 contains a broken access control vulnerability in the web-based control panel allowing authenticated low-privileged attackers to gain to access to arbitrary SMS messages via a crafted company or tenant identifier parameter. [CVSS 8.1 HIGH]

Authentication Bypass Opencode Ussd Gateway
NVD GitHub
EPSS 0% CVSS 6.1
MEDIUM POC PATCH This Month

OpenCode's markdown renderer fails to sanitize HTML input in LLM responses, allowing attackers who control the chat output to inject arbitrary JavaScript that executes in the localhost:4096 origin without Content Security Policy protections. Public exploit code exists for this cross-site scripting vulnerability, affecting users of the AI coding agent through versions prior to 1.1.10. An attacker can achieve session compromise or local code execution by manipulating LLM responses to inject malicious scripts.

XSS AI / ML Opencode
NVD GitHub
EPSS 0% CVSS 4.3
MEDIUM POC This Month

Incorrect access control in the /aux1/ocussd/trace endpoint of OpenCode Systems USSD Gateway OC Release:5, version 6.13.11 allows attackers with low-level privileges to read server logs. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Authentication Bypass Opencode Ussd Gateway
NVD GitHub
EPSS 0% CVSS 6.5
MEDIUM POC This Month

Incorrect access control in the getSubUsersByProvider function of OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 allows attackers with low-level privileges to dump user records and. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Authentication Bypass Opencode Ussd Gateway
NVD GitHub
EPSS 0% CVSS 6.1
MEDIUM POC This Month

A reflected cross-site scripted (XSS) vulnerability in OpenCode Systems USSD Gateway OC Release: 5 allows attackers to execute arbitrary JavaScript in the context of a user's browser via injecting a. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

XSS Opencode Ussd Gateway
NVD GitHub
EPSS 0% CVSS 9.8
CRITICAL POC Act Now

OpenCode Systems USSD Gateway OC Release: 5 was discovered to contain a SQL injection vulnerability via the Session ID parameter in the /occontrolpanel/index.php endpoint. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

PHP SQLi Opencode +1
NVD GitHub
EPSS 0% CVSS 9.8
CRITICAL POC Act Now

OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 was discovered to contain a SQL injection vulnerability via the ID parameter in the getSubUsersByProvider function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

SQLi Opencode Ussd Gateway
NVD GitHub

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy