critical2026-01-13 CVE-2026-22813-Malicious website can execute commands on the local system through XSS in the OpenCode web UI GHSA-c83v-7274-4vgp
high2026-01-13 CVE-2026-22812-OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution GHSA-vxw4-wv6m-9hhh