The vulnerability in OpenCode allows an attacker to inject arbitrary HTML into markdown rendered by the web UI without sanitization or CSP. By manipulating the LLM response in a chat session, an attacker can cause malicious JavaScript to execute within the http://localhost:4096 origin, enabling remote code execution on the local machine. This flaw is a classic reflected cross‑site scripting flaw (CWE‑79) that can lead to execution of arbitrary commands, theft of local credentials, or installation of malware, compromising confidentiality, integrity, and availability of the affected system.

All publicly released versions of AnomalyCo OpenCode from the beginning until 1.1.10 are affected. The vendor acknowledges a fix in version 1.1.10; any deployment running an earlier version, particularly default local installations, must be updated.

The CVSS score of 9.4 identifies this issue as Critical, and the low EPSS score (<1%) suggests that exploitation is not currently widespread. However the vulnerability is not cataloged in CISA's KEV, indicating that no public exploits are known at this time. The likely attack path involves tricking a user into visiting a malicious site that can feed the LLM with crafted prompts to trigger the injection. Because the JavaScript runs in the local origin, any privileges the local user holds will be granted to the attacker, making the risk significant especially for administrators. An attacker with remote code execution capabilities can compromise the entire machine.