{"vulnerability": "CVE-2026-22812", "sightings": [{"uuid": "0117ced4-1ad9-4067-bd4c-1967b6f6ceca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22812", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3me2rjuetsd2k", "content": "", "creation_timestamp": "2026-02-04T21:02:35.727961Z"}, {"uuid": "0d7fc860-8cb0-4fe6-91da-a5b38e01ec51", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22812", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mcbalrza2w2v", "content": "", "creation_timestamp": "2026-01-12T23:57:35.262948Z"}, {"uuid": "b7a47aec-400b-40a1-929a-e09a4c296222", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22812", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mcbh66jtcy2r", "content": "", "creation_timestamp": "2026-01-13T01:55:14.216809Z"}, {"uuid": "949a2695-5529-40cd-86c4-706b03d33afe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22812", "type": "seen", "source": "https://bsky.app/profile/basefortify.bsky.social/post/3mccgowyztc2t", "content": "", "creation_timestamp": "2026-01-13T11:19:29.428003Z"}, {"uuid": "516e1e51-95af-405a-8ecf-fff505c040df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22812", "type": "seen", "source": "https://bsky.app/profile/basefortify.bsky.social/post/3mccgozp4pk2t", "content": "", "creation_timestamp": "2026-01-13T11:19:29.918487Z"}, {"uuid": "4fafbf5a-a5bd-4beb-a153-e840fc9afbdb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22812", "type": "seen", "source": "https://bsky.app/profile/basefortify.bsky.social/post/3mccgozp6o22t", "content": "", "creation_timestamp": "2026-01-13T11:19:30.404181Z"}, {"uuid": "89663877-9bca-4cb5-93ee-d48a895daa14", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22812", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/115907662034351783", "content": "", "creation_timestamp": "2026-01-17T00:42:46.885131Z"}, {"uuid": "5b1be4e8-2a0c-4abb-8784-df2f2e1e1db9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22812", "type": "seen", "source": "https://gist.github.com/alon710/aa8ca3f229853e03b4f1c286127fcc6f", "content": "", "creation_timestamp": "2026-01-24T21:25:11.000000Z"}, {"uuid": "e5617699-ed2b-43e8-9ed8-63a50d5324b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-22812", "type": "seen", "source": "https://bsky.app/profile/securitycipher.bsky.social/post/3mhljsvpmxi2n", "content": "", "creation_timestamp": "2026-03-21T17:15:12.437237Z"}, {"uuid": "0bd6943d-6c37-4b86-88a5-8427070fa80c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22812", "type": "seen", "source": "https://gist.github.com/alon710/1dc0ed0d520f0819b06be2b5a73e16e1", "content": "", "creation_timestamp": "2026-01-24T22:40:41.000000Z"}, {"uuid": "2abb4244-7314-4d74-9a2b-e555c25cee5c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22812", "type": "seen", "source": "https://bsky.app/profile/narahari-dasa.bsky.social/post/3mieogujwsx27", "content": "", "creation_timestamp": "2026-03-31T17:14:30.754781Z"}, {"uuid": "d1fabeb9-1f75-4be8-a274-c045f20e8b38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22812", "type": "seen", "source": "https://bsky.app/profile/g0rosato.bsky.social/post/3mimre55vsz2u", "content": "", "creation_timestamp": "2026-04-03T22:27:58.935443Z"}, {"uuid": "0995648c-60b2-42da-9e08-a5bc61b56df2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22812", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/79059", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-22812\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xBlackash\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-06 07:42:36\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-22812\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-06T08:00:04.000000Z"}, {"uuid": "3579fc20-5d8d-4d48-aa7c-2573ad1b3150", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22812", "type": "published-proof-of-concept", "source": "Telegram/ZajfVU0NVHMB2Muj4M-mvXlhnMSYm4sTiRiw7Ql6Q5T1ODA", "content": "", "creation_timestamp": "2026-04-06T15:00:07.000000Z"}, {"uuid": "10963767-9b0c-4cff-912c-6e03728fc4af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22812", "type": "published-proof-of-concept", "source": "Telegram/Fln1CDV-IIlp7EGS7hr_JibbBYDcdeDsNTgWenTzMncUGCI", "content": "", "creation_timestamp": "2026-03-29T15:00:08.000000Z"}, {"uuid": "57e42242-e5e6-47aa-8033-82ed341cad61", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22812", "type": "seen", "source": "https://t.me/GithubRedTeam/77789", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a ai-agent-security-research\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a HodgeLuke\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-03-29 11:27:36\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nOpen security research on AI coding agent infrastructure. Agent-executable remediation manifests for CVE-2026-22812 and CVE-2026-22813.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-03-29T12:00:04.000000Z"}, {"uuid": "288d7b2c-61c0-42e0-afae-0e126e82fbaf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22812", "type": "published-proof-of-concept", "source": "Telegram/4zuUlGU6EvpMTWPbip1_D3Ts-W_MioI6unE3WF1UcmysLKI", "content": "", "creation_timestamp": "2026-01-13T00:02:07.000000Z"}, {"uuid": "7480f4f1-532b-420b-abea-e59f2fa8cefa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22812", "type": "seen", "source": "https://poliverso.org/objects/0477a01e-e8c8129d-b09e02c4de9c4f4a", "content": "Exploits and vulnerabilities in Q1 2026\nDuring Q1 2026, the exploit kits leveraged by threat actors to target user systems expanded once again, incorporating new exploits for the Microsoft Office platform, as well as Windows and Linux operating systems.\nIn this report, we dive into the statistics on published vulnerabilities and exploits, as well as the known vulnerabilities leveraged by popular C2 frameworks throughout Q1 2026.\nStatistics on registered vulnerabilities\nThis section provides statistical data on registered vulnerabilities. The data is sourced from cve.org.\nWe examine the number of registered CVEs for each month starting from January 2022. The total volume of vulnerabilities continues rising and, according to current reports, the use of AI agents for discovering security issues is expected to further reinforce this upward trend.\nTotal published vulnerabilities per month from 2022 through 2026 (download)\nNext, we analyze the number of new critical vulnerabilities (CVSS > 8.9) over the same period.\nTotal critical vulnerabilities published per month from 2022 through 2026 (download)\nThe graph indicates that while the volume of critical vulnerabilities slightly decreased compared to previous years, an upward trend remained clearly visible. At present, we attribute this to the fact that the end of last year was marked by the disclosure of several severe vulnerabilities in web frameworks. The current growth is driven by high-profile issues like React2Shell, the release of exploit frameworks for mobile platforms, and the uncovering of secondary vulnerabilities during the remediation of previously discovered ones. We will be able to test this hypothesis in the next quarter; if correct, the second quarter will show a significant decline, similar to the pattern observed in the previous year.\nExploitation statistics\nThis section presents statistics on vulnerability exploitation for Q1 2026. The data draws on open sources and our telemetry.\nWindows and Linux vulnerability exploitation\nIn Q1 2026, threat actor toolsets were updated with exploits for new, recently registered vulnerabilities. However, we first examine the list of veteran vulnerabilities that consistently account for the largest share of detections:\n\nCVE-2018-0802: a remote code execution (RCE) vulnerability in the Equation Editor component\nCVE-2017-11882: another RCE vulnerability also affecting Equation Editor\nCVE-2017-0199: a vulnerability in Microsoft Office and WordPad that allows an attacker to gain control over the system\nCVE-2023-38831: a vulnerability resulting from the improper handling of objects contained within an archive\nCVE-2025-6218: a vulnerability allowing the specification of relative paths to extract files into arbitrary directories, potentially leading to malicious command execution\nCVE-2025-8088: a directory traversal bypass vulnerability during file extraction utilizing NTFS Streams\nAmong the newcomers, we have observed exploits targeting the Microsoft Office platform and Windows OS components. Notably, these new vulnerabilities exploit logic flaws arising from the interaction between multiple systems, making them technically difficult to isolate within a specific file or library. A list of these vulnerabilities is provided below:\n\nCVE-2026-21509 and CVE-2026-21514: security feature bypass vulnerabilities: despite Protected View being enabled, a specially crafted file can still execute malicious code without the user\u2019s knowledge. Malicious commands are executed on the victim\u2019s system with the privileges of the user who opened the file.\nCVE-2026-21513: a vulnerability in the Internet Explorer MSHTML engine, which is used to open websites and render HTML markup. The vulnerability involves bypassing rules that restrict the execution of files from untrusted network sources. Interestingly, the data provider for this vulnerability was an LNK file.\nThese three vulnerabilities were utilized together in a single chain during attacks on Windows-based user systems. While this combination is noteworthy, we believe the widespread use of the entire chain as a unified exploit will likely decline due to its instability. We anticipate that these vulnerabilities will eventually be applied individually as initial entry vectors in phishing campaigns.\nBelow is the trend of exploit detections on user Windows systems starting from Q1 2025.\nDynamics of the number of Windows users encountering exploits, Q1 2025 \u2013 Q1 2026. The number of users who encountered exploits in Q1 2025 is taken as 100% (download)\nThe vulnerabilities listed here can be leveraged to gain initial access to a vulnerable system and for privilege escalation. This underscores the critical importance of timely software updates.\nOn Linux devices, exploits for the following vulnerabilities were detected most frequently:\n\nCVE-2022-0847: a vulnerability known as Dirty Pipe, which enables privilege escalation and the hijacking of running applications\nCVE-2019-13272: a vulnerability caused by improper handling of privilege inheritance, which can be exploited to achieve privilege escalation\nCVE-2021-22555: a heap out-of-bounds write vulnerability in the Netfilter kernel subsystem\nCVE-2023-32233: a vulnerability in the Netfilter subsystem that allows for Use-After-Free conditions and privilege escalation through the improper processing of network requests\nDynamics of the number of Linux users encountering exploits, Q1 2025 \u2013 Q1 2026. The number of users who encountered exploits in Q1 2025 is taken as 100% (download)\nIn the first quarter of 2026, we observed a decrease in the number of detected exploits; however, the detection rates are on the rise relative to the same period last year. For the Linux operating system, the installation of security patches remains critical.\nMost common published exploits\nThe distribution of published exploits by software type in Q1 2026 features an updated set of categories; once again, we see exploits targeting operating systems and Microsoft Office suites.\nDistribution of published exploits by platform, Q1 2026 (download)\nVulnerability exploitation in APT attacks\nWe analyzed which vulnerabilities were utilized in APT attacks during Q1 2026. The ranking provided below includes data based on our telemetry, research, and open sources.\nTOP 10 vulnerabilities exploited in APT attacks, Q1 2026 (download)\nIn Q1 2026, threat actors continued to utilize high-profile vulnerabilities registered in the previous year for APT attacks. The hypothesis we previously proposed has been confirmed: security flaws affecting web applications remain heavily exploited in real-world attacks. However, we are also observing a partial refresh of attacker toolsets. Specifically, during the first quarter of the year, APT campaigns leveraged recently discovered vulnerabilities in Microsoft Office products, edge networking device software, and remote access management systems. Although the most recent vulnerabilities are being exploited most heavily, their general characteristics continue to reinforce established trends regarding the categories of vulnerable software. Consequently, we strongly recommend applying the security patches provided by vendors.\nC2 frameworks\nIn this section, we examine the most popular C2 frameworks used by threat actors and analyze the vulnerabilities targeted by the exploits that interacted with C2 agents in APT attacks.\nThe chart below shows the frequency of known C2 framework usage in attacks against users during Q1 2026, according to open sources.\nTOP 10 C2 frameworks used by APTs to compromise user systems, Q1 2026 (download)\nMetasploit has returned to the top of the list of the most common C2 frameworks, displacing Sliver, which now shares the second position with Havoc. These are followed by Covenant and Mythic, the latter of which previously saw greater popularity. After studying open sources and analyzing samples of malicious C2 agents that contained exploits, we determined that the following vulnerabilities were utilized in APT attacks involving the C2 frameworks mentioned above:\n\nCVE-2023-46604: an insecure deserialization vulnerability allowing for arbitrary code execution within the server process context if the Apache ActiveMQ service is running\nCVE-2024-12356 and CVE-2026-1731: command injection vulnerabilities in BeyondTrust software that allow an attacker to send malicious commands even without system authentication\nCVE-2023-36884: a vulnerability in the Windows Search component that enables command execution on the system, bypassing security mechanisms built into Microsoft Office applications\nCVE-2025-53770: an insecure deserialization vulnerability in Microsoft SharePoint that allows for unauthenticated command execution on the server\nCVE-2025-8088 and CVE-2025-6218: similar directory traversal vulnerabilities that allow files to be extracted from an archive to a predefined path, potentially without the archiving utility displaying any alerts to the user\nThe nature of the described vulnerabilities indicates that they were exploited to gain initial access to the system. Notably, the majority of these security issues are targeted to bypass authentication mechanisms. This is likely due to the fact that C2 agents are being detected effectively, prompting threat actors to reduce the probability of discovery by utilizing bypass exploits.\nNotable vulnerabilities\nThis section highlights the most significant vulnerabilities published in Q1 2026 that have publicly available descriptions.\nCVE-2026-21519: Desktop Window Manager vulnerability\nAt the core of this vulnerability is a Type Confusion flaw. By attempting to access a resource within the Desktop Window Manager subsystem, an attacker can achieve privilege escalation. A necessary condition for exploiting this issue is existing authorization on the system.\nIt is worth noting that the DWM subsystem has been under close scrutiny by threat actors for quite some time. Historically, the primary attack vector involves interacting with the NtDComposition* function set.\nRegPwn (CVE-2026-21533): a system settings access control vulnerability\nCVE-2026-21533 is essentially a logic vulnerability that enables privilege escalation. It stems from the improper handling of privileges within Remote Desktop Services (RDS) components. By modifying service parameters in the registry and replacing the configuration with a custom key, an attacker can elevate privileges to the SYSTEM level. This vulnerability is likely to remain a fixture in threat actor toolsets as a method for establishing persistence and gaining high-level privileges.\nCVE-2026-21514: a Microsoft Office vulnerability\nThis vulnerability was discovered in the wild during attacks on user systems. Notably, an LNK file is used to initiate the exploitation process. CVE-2026-21514 is also a logic issue that allows for bypassing OLE technology restrictions on malicious code execution and the transmission of NetNTLM authentication requests when processing untrusted input.\nClawdbot (CVE-2026-25253): an OpenClaw vulnerability\nThis vulnerability in the AI agent leaks credentials (authentication tokens) when queried via the WebSocket protocol. It can lead to the compromise of the infrastructure where the agent is installed: researchers have confirmed the ability to access local system data and execute commands with elevated privileges. The danger of CVE-2026-25253 is further compounded by the fact that its exploitation has generated numerous attack scenarios, including the use of prompt injections and ClickFix techniques to install stealers on vulnerable systems.\nCVE-2026-34070: LangChain framework vulnerability\nLangChain is an open-source framework designed for building applications powered by large language models (LLMs). A directory traversal vulnerability allowed attackers to access arbitrary files within the infrastructure where the framework was deployed. The core of CVE-2026-34070 lies in the fact that certain functions within langchain_core/prompts/loading.py handled configuration files insecurely. This could potentially lead to the processing of files containing malicious data, which could be leveraged to execute commands and expose critical system information or other sensitive files.\nCVE-2026-22812: an OpenCode vulnerability\nCVE-2026-22812 is another vulnerability identified in AI-assisted coding software. By default, the OpenCode agent provided local access for launching authorized applications via an HTTP server that did not require authentication. Consequently, attackers could execute malicious commands on a vulnerable device with the privileges of the current user.\nConclusion and advice\nWe observe that the registration of vulnerabilities is steadily gaining momentum in Q1 2026, a trend driven by the widespread development of AI tools designed to identify security flaws across various software types. This trajectory is likely to result not only in a higher volume of registered vulnerabilities but also in an increase in exploit-driven attacks, further reinforcing the critical necessity of timely security patch deployment. Additionally, organizations must prioritize vulnerability management and implement effective defensive technologies to mitigate the risks associated with potential exploitation.\nTo ensure the rapid detection of threats involving exploit utilization and to prevent their escalation, it is essential to deploy a reliable security solution. Key features of such a tool include continuous infrastructure monitoring, proactive protection, and vulnerability prioritization based on real-world relevance. These mechanisms are integrated into Kaspersky Next, which also provides endpoint security and protection against cyberattacks of any complexity. \nsecurelist.com/vulnerabilities\u2026", "creation_timestamp": "2026-05-07T10:52:28.003779Z"}, {"uuid": "33dc40b3-99f6-4d14-bee2-1f338a749687", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-22812", "type": "published-proof-of-concept", "source": "https://github.com/anomalyco/opencode/security/advisories/GHSA-vxw4-wv6m-9hhh", "content": "", "creation_timestamp": "2026-01-12T19:43:04.000000Z"}, {"uuid": "198f3306-980c-485d-9c30-3f3cdcf9cda7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22812", "type": "seen", "source": "https://t.me/proxy_bar/3074", "content": "CVE-2026-22812 OpenCode Unauthenticated RCE\n*\nOpenCode < 1.0.216\n*\nexploit", "creation_timestamp": "2026-07-20T19:00:08.411516Z"}, {"uuid": "86bb38bc-c808-4203-9ec8-bf922b09c573", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22812", "type": "seen", "source": "https://gist.github.com/cmdcolin/d99da97b752ad55b536f8d2fe63d0415", "content": "# A response to \"Stop Using OpenCode\"\n\nHuman note: I used Claude Code opus to generate this\n\nPlease read https://wren.wtf/shower-thoughts/stop-using-opencode/ it is a recent blog post trying to critique the opencode codebase. please try to debunk the post and show misunderstandings. you can cross reference ~/src/opencode source code if you want\n\nIt generated the following:\n\n\nEvery claim below was checked against the opencode source tree at `849c2598` (2026-07-20).\nFile and line references point at that commit.\n\n---\n\n## TL;DR\n\nThe post makes one structural argument and about a dozen specific ones.\n\nThe structural argument \u2014 parsing shell command text can never be a security boundary \u2014 is\n**correct, and equally true of every coding agent that runs shell commands.** It's a\nproperty of the category. It cannot support a conclusion of the form \"stop using *this\none*.\"\n\nThe specific arguments are **mostly wrong.** Four of the post's central claims are\ncontradicted by the very files it cites. One is contradicted by a two-second grep.\n\nThe post did find one real, unfixed bug. It's in Part 3, explained rather than asserted.\n\n---\n\n# Part 1 \u2014 The headline doesn't follow\n\nYou don't need to read any code to see the problem.\n\nThe post's core technical case is that opencode's command analysis can be defeated:\n`echo '...' | bash`, base64 pipes, `python3 -c`, heredocs. Every one of those works against\nevery agent that executes shell commands. None of it is specific to opencode.\n\n**Nor is it fixable at the parse layer.** Ask what a filter would have to do with\n`python3 -c ''`. To decide whether that's safe you must decide what an\narbitrary program does. That's Rice's theorem \u2014 not a matter of trying harder, and not a\nmatter of adding `sed` and `awk` to a list. Every blocklist entry is a hint toward the next\nbypass. Everyone who has seriously attempted this \u2014 Windows AppLocker, PHP `safe_mode`,\nrestricted shells \u2014 reached the same conclusion and moved enforcement below the\ninterpreter.\n\nStated honestly, the argument is: *agents that run shell commands need OS-level isolation.*\nTrue, important, and an indictment of the entire category. Aiming it at one member is the\nsleight of hand at the center of this post.\n\n### Two threat models, routinely conflated\n\n**The model makes a mistake.** It runs `rm -rf` on the wrong path, force-pushes, drops a\ntable. Parsing genuinely helps here, because a mistaken model isn't evading you \u2014 it writes\n`git push --force` in plain text. This is what opencode's classifier is built for.\n\n**Prompt injection.** Attacker-controlled text in the context window \u2014 a README, an issue\nbody, a fetched page, MCP output \u2014 steers the agent. Parsing is worth exactly zero here,\nbecause the attacker picks the encoding. The post's bypass list is a demonstration of this\ngeneral fact, mislabeled as an opencode defect.\n\nConflating the two is what makes a UX classifier look like a broken security control.\n\n### What would actually help\n\nNone of it lives in the agent:\n\n- **Network egress control.** The underrated one. For injection, exfiltration is usually\n  the objective; an agent that can't reach the network is far less useful to an attacker\n  no matter what shell it runs.\n- **Filesystem scoping**, so \"outside the project\" is enforced rather than asked about.\n- **Process isolation** \u2014 containers, VMs, devcontainers, or OS primitives (seatbelt,\n  landlock, bubblewrap).\n- **Recoverable blast radius** \u2014 checkpoints, disposable worktrees, scoped credentials\n  instead of ambient `~/.aws`.\n\nNone of these care what the command *text* looks like. That's the tell for where the\nboundary belongs.\n\n### The fair version of this criticism\n\nopencode ships no OS-level sandbox integration. Grepping for `seatbelt`, `sandbox-exec`,\n`bubblewrap`, `landlock`, `firejail`, and `nsjail` across the tree returns nothing. The only\n`sandbox` identifiers in the source refer to git worktrees, and the Dockerfile ships the\nserver rather than isolating tool execution.\n\nThat's a real gap, with two honest asks \u2014 neither of which is \"write a better parser\":\n\n1. **Ship a first-class sandbox mode.** seatbelt on macOS, landlock or bubblewrap on Linux,\n   or a blessed devcontainer path, recommended for untrusted repositories.\n2. **Say plainly in the docs** that the permission system is accident-prevention and\n   intent-summarization, not containment. The docs don't claim otherwise today, but they\n   don't disclaim it either, and that ambiguity is what lets a post like this land.\n\nGood issue. Not \"stop using opencode,\" and not \"opencode is uniquely unsafe.\"\n\n---\n\n# Part 2 \u2014 The four factual errors\n\nThe load-bearing specifics. Each takes about thirty seconds to check.\n\n### 1. Approved permissions are NOT written to disk\n\n> Claim: answering \"Always\" persists on disk and grants that command in all future sessions.\n\nThe post's scariest claim, and it's false.\n\n`permission/index.ts:24` declares `approved` inside `State`. `State` is built by\n`InstanceState.make` (line 47). `InstanceState` (`effect/instance-state.ts:29`) is a\n`ScopedCache` keyed by working directory \u2014 in-memory, torn down when the process exits.\n\n```\n$ grep -rn \"approved\" packages/opencode/src/permission/\n```\n\nSix hits. All reads and in-memory pushes. Zero writes to disk.\n\n**\"Always\" lasts until you quit.**\n\n### 2. Unrecognized commands don't bypass anything \u2014 they prompt you\n\nThe post lists commands it says defeat the filter (`echo '...' | bash`, `env git status`,\n`$(which git) status`, base64 pipes). Here is what happens when the parser doesn't\nrecognize something \u2014 `permission/index.ts:29-37`:\n\n```ts\nreturn rulesets.flat().findLast((rule) => \u2026) ?? {\n  action: \"ask\",          // \u2190 the fallback\n  permission,\n  pattern: \"*\",\n}\n```\n\n**Unrecognized means ask.** You get an interactive prompt showing the literal command text.\nNothing runs silently.\n\nWhat these strings actually do is fail to match a *user-authored deny rule*, after which\nyou get asked. \"My deny rule for `git *` doesn't catch base64-encoded git\" is a real\nlimitation and a very different sentence from \"the security filter is useless.\"\n\n### 3. The default config doesn't gate bash at all \u2014 by design\n\n`agent/agent.ts:119-136`:\n\n```ts\nconst defaults = Permission.fromConfig({\n  \"*\": \"allow\",\n  doom_loop: \"ask\",\n  external_directory: { \"*\": \"ask\", \u2026 },\n  question: \"deny\",\n  plan_enter: \"deny\",\n  plan_exit: \"deny\",\n  read: { \"*\": \"allow\", \"*.env\": \"ask\", \"*.env.*\": \"ask\", \u2026 },\n})\n```\n\nOut of the box, bash is `allow`. There is nothing to bypass, because nothing is gated.\n\nThe tree-sitter machinery exists to make two *ergonomic* features work: matching\nuser-written rules in `opencode.json`, and computing a sensible prefix for the \"Always\"\nbutton. Judging it as a failed sandbox is like judging `.gitignore` as failed access\ncontrol.\n\nNote what the defaults *do* gate: external directories, `.env` files, doom loops. A\ncoherent \"catch accidents and limit injection reach\" posture \u2014 the first threat model from\nPart 1 \u2014 and not a claim to contain an adversarial model.\n\n### 4. Two of the \"AST bypasses\" are already handled in the cited file\n\n**Redirection.** The post correctly notes that `>` is a sibling of the command in the\ntree-sitter AST, then concludes `echo 21 > /sys/class/gpio/export` escapes validation. But\n`tool/shell.ts:119` exists for exactly this:\n\n```ts\nfunction source(node: Node) {\n  return (node.parent?.type === \"redirected_statement\" ? node.parent.text : node.text).trim()\n}\n```\n\nThe permission pattern is the **full redirected statement**, target included.\n\n**`cd` and friends.** The post says the `CWD` set bypasses all permission checks.\n`shell.ts:28-30`:\n\n```ts\nconst CWD = new Set([\"cd\", \"chdir\", \"popd\", \"pushd\", \"push-location\", \"set-location\"])\nconst FILES = new Set([\n  ...CWD,        // \u2190 CWD is a subset of FILES\n  \"rm\", \"cp\", \"mv\", \u2026\n])\n```\n\n`cd`'s path arguments *are* resolved and *do* raise an `external_directory` prompt when they\nleave the project (`shell.ts:397-405`). The only thing skipped for a bare `cd` is adding a\nbash pattern \u2014 because `cd` executes nothing. And `cd /etc && rm -rf .` still produces a\npattern for the `rm`: `commands()` at line 123 is `descendantsOfType(\"command\")`, a full\nrecursive walk.\n\n---\n\n# Part 3 \u2014 What the post gets right\n\n## The `opencode.ai` CORS exception\n\nThe post's best finding, and the one worth acting on. It needs more explanation than the\npost gives it, because \"CORS bug in a CLI tool\" sounds like a category error until you see\nthe architecture.\n\n**opencode is not just a CLI.** The TUI is a client of a local HTTP server that opencode\nstarts, and that server exposes APIs which run shell commands and read files. Browsers can\nreach `127.0.0.1`. The same-origin policy normally lets a web page *send* such a request\nbut not *read* the response \u2014 CORS is the mechanism that lifts that restriction. So the\nallowlist decides who gets to read.\n\n`packages/server/src/cors.ts:3`:\n\n```ts\nconst opencodeOrigin = /^https:\\/\\/([a-z0-9-]+\\.)*opencode\\.ai$/\n```\n\nEvery opencode.ai subdomain, permanently, with no way to opt out.\n\n**And there is no auth behind it.** `server/auth.ts:24` \u2014 `required()` is true only when\n`OPENCODE_SERVER_PASSWORD` is set, and the middleware short-circuits to a no-op when it\nisn't (`authorization.ts:103`). Unset by default. For a matching origin, CORS *is* the\nentire access control story.\n\n**Calibration.** This is a chain, not a one-shot. An attacker needs XSS on some opencode.ai\nsubdomain, and has to locate the port, which is ephemeral (`network.ts`, `port: default 0`).\nBrowser-based localhost port scanning is well-known and workable, but it's a speed bump the\npost doesn't mention. The share feature \u2014 which renders session content, including model\noutput and file contents, on that domain \u2014 is the surface to worry about.\n\nReal bug, worth fixing, not a drive-by RCE. The fix is cheap: make the exception opt-in, or\nscope it to a single known origin instead of a subdomain wildcard.\n\n## Everything else the post is right about\n\n**\"Always\" over-grants.** `python3` isn't in the `ARITY` table (`permission/arity.ts`), so\n`prefix()` falls back to `tokens.slice(0, 1)` \u2192 `python3 *`. Approving\n`python3 -c 'print(1)'` does grant all `python3` \u2014 for the session (Part 2 \u00a71), not forever.\n\n**Rejecting one prompt kills its siblings.** `permission/index.ts:126-135` cascades `reject`\nto every pending request in the session. This explains the subagent behavior the post\ncomplains about.\n\n**No persistent \"Never.\"** Replies are `once | always | reject`. Making a denial stick means\nhand-editing `opencode.json`.\n\n**Date in the system prompt.** `session/system.ts:74` \u2014 one cache miss per session per\nmidnight crossing.\n\n**No OS-level sandboxing.** Part 1. The correct version of the post's thesis.\n\n---\n---\n\n# Part 4 \u2014 Detailed responses\n\n## Security claims\n\n### models.dev \"downloads the default model URL\"\n\nThree separate errors:\n\n1. **The catalog ships in the binary.** `script/build.ts:195` bakes it in as\n   `OPENCODE_MODELS_DEV`; `core/src/models-dev.ts:192` loads that snapshot.\n2. **It's overridable and disableable.** `OPENCODE_MODELS_URL` (`models-dev.ts:154`) and\n   `OPENCODE_DISABLE_MODELS_FETCH` (line 217).\n3. **Your config always wins.** At the exact line the post cites in `provider.ts`:\n\n   ```ts\n   let url = typeof options[\"baseURL\"] === \"string\" && options[\"baseURL\"] !== \"\"\n     ? options[\"baseURL\"]\n     : model.api.url\n   ```\n\nSeparately: models.dev is a *metadata* catalog \u2014 pricing, context limits, model IDs.\n\"Where opencode learns which server to talk to\" overstates what it is.\n\n### CVE-2026-22812 and the exposed HTTP server\n\nReal history; the description no longer matches the code. `cli/network.ts:8-18`:\n\n```ts\nport:     { default: 0 },            // ephemeral, not \"well-known\"\nhostname: { default: \"127.0.0.1\" },  // loopback\ncors:     { default: [] },           // no user-supplied origins\n```\n\n\"Well-known default port\" is stale. The `opencode.ai` exception (Part 3) is the part that\nstill stands \u2014 and it's strong enough to argue on its own rather than bundled with fixed\nissues, which is the choice that undermines it.\n\n### Self-upgrade / curlbash\n\n`cli/upgrade.ts:10` gates on `config.autoupdate !== false` **and**\n`!OPENCODE_DISABLE_AUTOUPDATE`. Line 30 bails to notify-only for anything that isn't a\n**patch** bump:\n\n```ts\nif (config.autoupdate === \"notify\" || kind !== \"patch\") { /* notify, return */ }\n```\n\nAuto-applied updates are patch-level only, via the install method you already chose, with\ntwo independent off switches.\n\n### \"Remote-first architecture\"\n\nLocal providers are first-class and documented: `docs/providers.mdx:1422` (LM Studio),\n`:1594` (Ollama, with upstream integration docs). A cloud default is a product decision, not\nan architectural commitment to remote inference.\n\n### The `FILES` list\n\nThe post describes `FILES` as \"commands assumed not to access files.\" It's the inverse \u2014\n`FILES` (`shell.ts:29`) is the allowlist of commands whose arguments get *path-resolved* for\nthe `external_directory` check. Commands outside it aren't waved through; they don't\ncontribute directory prompts, and still contribute bash permission patterns.\n\nThat `sed`, `awk`, and `tee` are missing is a fair catch and a good PR \u2014 with the Part 1\ncaveat that completing the list doesn't make it a boundary.\n\n## Performance and cache claims\n\n### `PRUNE_PROTECT = 40_000`\n\nThe post quotes one of three constants governing pruning. `compaction.ts:28-31`:\n\n```ts\nexport const PRUNE_MINIMUM = 20_000\nexport const PRUNE_PROTECT = 40_000\nconst PRUNE_PROTECTED_TOOLS = [\"skill\"]\n```\n\n`PRUNE_MINIMUM` is the one that matters for the cache argument. `compaction.ts:278`:\n\n```ts\nif (pruned > PRUNE_MINIMUM) { /* only now do we actually prune */ }\n```\n\nPruning is a **no-op unless it would reclaim more than 20k tokens** \u2014 precisely the\nanti-thrash mechanism the post says is absent. You never pay a cache invalidation to reclaim\n3k. Two more protections in the same loop: `compaction.ts:258` (`if (turns < 2) continue`)\nskips the entire most-recent turn, and `config.ts:582` (`OPENCODE_DISABLE_PRUNE`) turns it\noff.\n\nThe surviving critique \u2014 40k is fixed rather than a fraction of the model's context window \u2014\nis a reasonable issue to file.\n\n### \"Re-reads AGENTS.md on every SSE turn\"\n\nReal, and understated. `instruction.system()` is called at `session/prompt.ts:1260`, inside\nthe **step** loop \u2014 every model request, including every tool-call round trip. `read()`\n(`instruction.ts:91`) is a plain `fs.readFileString` with no mtime check and no memoization.\n\nThe conclusion doesn't follow. **Re-reading a file does not invalidate a prompt cache;\nchanged content does.** If AGENTS.md hasn't been edited, `read()` returns the same string,\nthe system prompt is byte-identical, and the cache hits as before. The cost is one small\ndisk read per step, issued 8-way concurrent (`instruction.ts:162`).\n\nWhat it buys is a real feature: **edit AGENTS.md mid-session and the next tool call picks it\nup** \u2014 no restart, no reload. For a file whose whole purpose is steering the agent, noticing\nedits immediately is the behavior you want, and this is the most eager option available.\n\nA deliberate trade with negligible cost and an obvious benefit, filed as a performance\ndefect. The clearest instance of the post's pattern: identify a real mechanism, then assert\na consequence that doesn't follow from it.\n\n### Current date in the system prompt\n\n`session/system.ts:74` \u2014 accurate. Every major harness does this, because models reason\nbadly about \"now\" without it.\n\n### TUI complaints\n\nRAM usage, shift-enter, markdown re-render, autoscroll versus text selection. Subjective or\nenvironment-dependent; not reproduced here. They may be entirely correct \u2014 they're also\nordinary bug reports rather than evidence the project is unsound, and they're the claims\nbest filed as issues.\n\n## Prompt claims\n\n### Verbosity, `beast.txt`, \"ABSOLUTELY NO COMMENTS\"\n\nFair as taste. Reasonable people disagree about prompt length, and every harness has\nembarrassing lines in its prompts. Not evidence of anything structural.\n\n### The WebFetch instruction\n\n> \"NEVER generate or guess URLs \u2026 unless you are confident that the URLs are for helping the\n> user with programming.\"\n\nCalled contradictory. It's a carve-out: don't invent URLs generally, except where guessing a\ndocs URL is the obviously useful behavior. Clumsily worded, yes. Encouraging URL guessing,\nno.\n\n### Plan mode writing to `.opencode/plans`\n\nAccurate, and \"claims it can't write anywhere, actually writes here\" is fair criticism of the\nprompt's wording. The default ruleset does deny `plan_enter` and `plan_exit`\n(`agent.ts:127-128`), so mode transitions are themselves gated.\n\n---\n\n## Method note\n\nWhere the post cites a file, I read that file. Where it cites a constant, I read the\nsurrounding function. Four of its central claims are contradicted by the code it points at;\none by a grep.\n\nThe frustrating part is that the argument didn't need any of them. \"Shell-command\nclassifiers aren't sandboxes, agents should ship OS isolation, and here's a live CORS hole\non a server with no auth\" is a strong post \u2014 and one that applies to the whole category\nrather than a single project. Nine findings that don't survive opening the file don't\nstrengthen it. They give everyone a reason to stop reading before the good part.", "creation_timestamp": "2026-07-20T20:08:53.650595Z"}, {"uuid": "e2229447-4973-4517-aab9-53a165425869", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22812", "type": "seen", "source": "https://t.me/proxy_bar/3074", "content": "CVE-2026-22812 OpenCode Unauthenticated RCE\n*\nOpenCode < 1.0.216\n*\nexploit", "creation_timestamp": "2026-07-21T00:00:27.034757Z"}, {"uuid": "67080a3a-161b-4d6d-a46a-e3ff6d762935", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22812", "type": "published-proof-of-concept", "source": "https://t.me/proxy_bar/3074", "content": "CVE-2026-22812 OpenCode Unauthenticated RCE\n*\nOpenCode < 1.0.216\n*\nexploit", "creation_timestamp": "2026-07-22T00:00:27.241198Z"}, {"uuid": "dab13e74-018c-43f2-ba42-418040f9a903", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22812", "type": "seen", "source": "https://t.me/EchelonEyes/4280", "content": "\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f RCE \u0432 OpenCode: \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0438 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0437\u0430\u043f\u0443\u0441\u043a, \u043d\u043e \u0441\u0435\u0440\u0432\u0435\u0440 \u043e\u0441\u0442\u0430\u0435\u0442\u0441\u044f \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u043c\n\n\u0412 OpenCode \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 (CVE-2026-22812). \u0412 \u0440\u0430\u043d\u043d\u0438\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 OpenCode \u0441\u0435\u0440\u0432\u0435\u0440 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u043b\u0441\u044f \u0438 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u043b \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u0431\u0435\u0437 \u043a\u0430\u043a\u043e\u0439 \u043b\u0438\u0431\u043e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. \u041b\u044e\u0431\u043e\u0439 \u043a\u043b\u0438\u0435\u043d\u0442, \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0432\u0448\u0438\u0439\u0441\u044f \u043a \u043d\u0435\u043c\u0443, \u043f\u043e\u043b\u0443\u0447\u0430\u043b \u043f\u043e\u043b\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 OpenCode \u0447\u0435\u0440\u0435\u0437 \u0435\u0433\u043e API. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u0441\u0435\u0440\u0432\u0435\u0440 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d, \u043d\u043e \u043f\u0440\u0438 \u0440\u0443\u0447\u043d\u043e\u043c \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u2014 \u043b\u044e\u0431\u043e\u0439 \u043a\u043b\u0438\u0435\u043d\u0442 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0442\u0430\u043a\u043e\u0439 \u0436\u0435 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c.\n\n\u041f\u0440\u0438 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u043b\u044e\u0431\u043e\u0439 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0439 \u043f\u0440\u043e\u0446\u0435\u0441\u0441, \u0432\u0435\u0431-\u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0430 \u0441 \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u043a localhost \u0438\u043b\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e \u0432 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0444\u043b\u0430\u0433\u0430 --mdns \u043c\u043e\u0436\u0435\u0442 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0441\u0435\u0440\u0432\u0435\u0440\u0443 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u0438\u0445 \u043d\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u0414\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0440\u0438\u0441\u043a \u0441\u043e\u0437\u0434\u0430\u0435\u0442 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u043d\u044b\u0439 CORS \u0434\u043b\u044f *.opencode.ai: \u043f\u0440\u0438 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0441\u0430\u0439\u0442\u0430 \u0438\u043b\u0438 XSS \u043d\u0430 \u043f\u043e\u0434\u0434\u043e\u043c\u0435\u043d\u0430\u0445 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0441\u043c\u043e\u0433\u0443\u0442 \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0441 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u044b\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c.\n\n\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c OpenCode \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 1.1.10 \u0438\u043b\u0438 \u0432\u044b\u0448\u0435, \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e \u0438 \u043d\u0435 \u0432\u043a\u043b\u044e\u0447\u0430\u0442\u044c \u0441\u0435\u0440\u0432\u0435\u0440 \u0431\u0435\u0437 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438. \u041d\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0444\u043b\u0430\u0433 --mdns \u0438 \u043d\u0435 \u043f\u043e\u0441\u0435\u0449\u0430\u0442\u044c opencode.ai \u043f\u0440\u0438 \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0435\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0432\u0441\u0435\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443, \u0438\u043d\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u043e \u0440\u0430\u0431\u043e\u0442\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u044c TLS, \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442\u044c CORS \u0438 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u043e\u043f\u0438\u0441\u0430\u0442\u044c \u0440\u0438\u0441\u043a\u0438 \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0441 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c\u0438 OpenCode \u043f\u044b\u0442\u0430\u043b\u0438\u0441\u044c \u0441\u0432\u044f\u0437\u0430\u0442\u044c\u0441\u044f \u043f\u043e\u0447\u0442\u0438 \u0434\u0432\u0430 \u043c\u0435\u0441\u044f\u0446\u0430.\n\n#\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c #\u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c #RCE\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://eyes.etecs.ru/r/d81c9a", "creation_timestamp": "2026-07-26T02:00:25.906273Z"}, {"uuid": "e4227628-001d-450b-a6fd-71a5497119fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22812", "type": "published-proof-of-concept", "source": "https://t.me/EchelonEyes/4280", "content": "\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f RCE \u0432 OpenCode: \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0438 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0437\u0430\u043f\u0443\u0441\u043a, \u043d\u043e \u0441\u0435\u0440\u0432\u0435\u0440 \u043e\u0441\u0442\u0430\u0435\u0442\u0441\u044f \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u043c\n\n\u0412 OpenCode \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 (CVE-2026-22812). \u0412 \u0440\u0430\u043d\u043d\u0438\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 OpenCode \u0441\u0435\u0440\u0432\u0435\u0440 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u043b\u0441\u044f \u0438 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u043b \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u0431\u0435\u0437 \u043a\u0430\u043a\u043e\u0439 \u043b\u0438\u0431\u043e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. \u041b\u044e\u0431\u043e\u0439 \u043a\u043b\u0438\u0435\u043d\u0442, \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0432\u0448\u0438\u0439\u0441\u044f \u043a \u043d\u0435\u043c\u0443, \u043f\u043e\u043b\u0443\u0447\u0430\u043b \u043f\u043e\u043b\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 OpenCode \u0447\u0435\u0440\u0435\u0437 \u0435\u0433\u043e API. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u0441\u0435\u0440\u0432\u0435\u0440 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d, \u043d\u043e \u043f\u0440\u0438 \u0440\u0443\u0447\u043d\u043e\u043c \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u2014 \u043b\u044e\u0431\u043e\u0439 \u043a\u043b\u0438\u0435\u043d\u0442 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0442\u0430\u043a\u043e\u0439 \u0436\u0435 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c.\n\n\u041f\u0440\u0438 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u043b\u044e\u0431\u043e\u0439 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0439 \u043f\u0440\u043e\u0446\u0435\u0441\u0441, \u0432\u0435\u0431-\u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0430 \u0441 \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u043a localhost \u0438\u043b\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e \u0432 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0444\u043b\u0430\u0433\u0430 --mdns \u043c\u043e\u0436\u0435\u0442 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0441\u0435\u0440\u0432\u0435\u0440\u0443 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u0438\u0445 \u043d\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u0414\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0440\u0438\u0441\u043a \u0441\u043e\u0437\u0434\u0430\u0435\u0442 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u043d\u044b\u0439 CORS \u0434\u043b\u044f *.opencode.ai: \u043f\u0440\u0438 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0441\u0430\u0439\u0442\u0430 \u0438\u043b\u0438 XSS \u043d\u0430 \u043f\u043e\u0434\u0434\u043e\u043c\u0435\u043d\u0430\u0445 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0441\u043c\u043e\u0433\u0443\u0442 \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0441 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u044b\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c.\n\n\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c OpenCode \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 1.1.10 \u0438\u043b\u0438 \u0432\u044b\u0448\u0435, \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e \u0438 \u043d\u0435 \u0432\u043a\u043b\u044e\u0447\u0430\u0442\u044c \u0441\u0435\u0440\u0432\u0435\u0440 \u0431\u0435\u0437 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438. \u041d\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0444\u043b\u0430\u0433 --mdns \u0438 \u043d\u0435 \u043f\u043e\u0441\u0435\u0449\u0430\u0442\u044c opencode.ai \u043f\u0440\u0438 \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0435\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0432\u0441\u0435\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443, \u0438\u043d\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u043e \u0440\u0430\u0431\u043e\u0442\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u044c TLS, \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442\u044c CORS \u0438 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u043e\u043f\u0438\u0441\u0430\u0442\u044c \u0440\u0438\u0441\u043a\u0438 \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0441 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c\u0438 OpenCode \u043f\u044b\u0442\u0430\u043b\u0438\u0441\u044c \u0441\u0432\u044f\u0437\u0430\u0442\u044c\u0441\u044f \u043f\u043e\u0447\u0442\u0438 \u0434\u0432\u0430 \u043c\u0435\u0441\u044f\u0446\u0430.\n\n#\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c #\u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c #RCE\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://eyes.etecs.ru/r/d81c9a", "creation_timestamp": "2026-07-27T00:00:10.096763Z"}]}