OpenCode is an open source AI coding agent. The markdown renderer used for LLM responses will insert arbitrary HTML into the DOM. There is no sanitization with DOMPurify or even a CSP on the web interface to prevent JavaScript execution via HTML injection. This means controlling the LLM response for a chat session gets JavaScript execution on the http://localhost:4096 origin. This vulnerability is fixed in 1.1.10.
The Markdown renderer used to display LLM responses inserts unsanitized HTML directly into the browser's DOM. The web interface does not use the DOMPurify library nor does it define a Content Security Policy (CSP) header, meaning there is no barrier blocking embedded JavaScript code. An attacker who is able to control the content of the LLM response — for example through prepared malicious input to the chat session (prompt injection) — can thereby obtain JavaScript execution on the application's local origin.
An attacker can execute arbitrary JavaScript code in the context of the application running on http://localhost:4096, which may lead to session hijacking, theft of data stored by the application, or further attacks on locally available resources.
OpenCode should be updated to version 1.1.10, in which the vulnerability has been fixed. Detailed information is available in the vendor's references: https://github.com/anomalyco/opencode/security/advisories/GHSA-c83v-7274-4vgp
Anoma OpenCode — versions before 1.1.10
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XAnoma Opencode
APPAnoma< 1.1.10