npm - OSV

GHSA-c83v-7274-4vgp

npm/opencode-ai

Malicious website can execute commands on the local system through XSS in the OpenCode web UI 13 Jan

Fix available
Severity - 9.4 (Critical)

GHSA-vxw4-wv6m-9hhh

npm/opencode-ai

OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution 13 Jan

Fix available
Severity - 8.8 (High)