VulertSecurity VulertSecurity

Vulnerability Database · npm · Package report

opencode-ai: vulnerability history, versions and safety

opencode-ai is a package in the npm ecosystem. Vulert records 2 vulnerabilities for it across 111 releases, first recorded in Jan 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
2 vulnerabilities recorded C1 H1
i
0 with no fix published

Every vulnerability has a patched version to move to.

i
2 in the last 12 months

Most recent disclosure 13 Jan 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all opencode-ai vulnerabilities

Vulert verdict on opencode-ai 1.19.4 i

Updated on 23 Oct 2026

Good news: 1.19.4, the version you would install today, has no known vulnerabilities. Older releases do — the table below lists all 2.

Package health score 83/100
  • Security Minor issues
  • Maintenance Sustainable
  • Popularity Not enough data
  • Community Not enough data

What to do: Stay on 1.19.4 or newer. This can change: a vulnerability disclosed tomorrow can affect 1.19.4 too — Vulert watches the package and alerts you if that happens. Monitor it with Vulert →

  • Current release 1.19.4 — unaffected i
  • Vulnerabilities on record 2 over 1 year · 2 in the last year i
  • Latest disclosure 13 Jan 2026 i
  • Highest CVSS 9.4 i
  • With no published fix 0 i
  • Last release this month i
  • Licence MIT i

Version list, release dates, licence and dependants published by the npm registry, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for opencode-ai, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
0.0.0-dev-202610221304 22 Oct 2026 C1 H1 MIT Yes Details →
1.19.4 22 Oct 2026 none MIT — Details →
0.0.0-dev-202610221224 22 Oct 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202610161232 16 Oct 2026 C1 H1 MIT Yes Details →
1.19.3 16 Oct 2026 none MIT — Details →
0.0.0-dev-202610161157 16 Oct 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202610161137 16 Oct 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202610160231 16 Oct 2026 C1 H1 MIT Yes Details →
1.19.2 16 Oct 2026 none MIT — Details →
0.0.0-dev-202610160120 16 Oct 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202610151921 15 Oct 2026 C1 H1 MIT Yes Details →
1.19.1 15 Oct 2026 none MIT — Details →
0.0.0-dev-202610151819 15 Oct 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202610141901 14 Oct 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202610130450 13 Oct 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202610110139 11 Oct 2026 C1 H1 MIT Yes Details →
1.19.0 11 Oct 2026 none MIT — Details →
0.0.0-dev-202610110108 11 Oct 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202610110054 11 Oct 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202610102323 10 Oct 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202610092229 09 Oct 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202610092204 09 Oct 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202610081429 08 Oct 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202610081410 08 Oct 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202610081348 08 Oct 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202610081323 08 Oct 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202610080611 08 Oct 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202610080552 08 Oct 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202610080331 08 Oct 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202610071936 07 Oct 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202610071918 07 Oct 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202610071728 07 Oct 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202610071607 07 Oct 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202610062254 06 Oct 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202610062230 06 Oct 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202610062213 06 Oct 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202610062156 06 Oct 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202610062133 06 Oct 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202610062019 06 Oct 2026 C1 H1 MIT Yes Details →
1.18.35 06 Oct 2026 none MIT — Details →
0.0.0-dev-202610061629 06 Oct 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202610061612 06 Oct 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202610061030 06 Oct 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202610060234 06 Oct 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202610060212 06 Oct 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202610052145 05 Oct 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202610052007 05 Oct 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202610051942 05 Oct 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202610051847 05 Oct 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202610030456 03 Oct 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202610022056 02 Oct 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202610021559 02 Oct 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202610020321 02 Oct 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202610012141 01 Oct 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202610012120 01 Oct 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202610012059 01 Oct 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202610011625 01 Oct 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202610011513 01 Oct 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202610010447 01 Oct 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202610010422 01 Oct 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202610010240 01 Oct 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202609302240 30 Sep 2026 C1 H1 MIT Yes Details →
1.18.34 30 Sep 2026 none MIT — Details →
0.0.0-dev-202609302040 30 Sep 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202609301753 30 Sep 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202609301623 30 Sep 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202609292145 29 Sep 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202609291934 29 Sep 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202609282300 28 Sep 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202609282011 28 Sep 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202609281952 28 Sep 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202609281631 28 Sep 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202609281608 28 Sep 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202609281545 28 Sep 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202609281346 28 Sep 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202609281326 28 Sep 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202609281305 28 Sep 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202609281134 28 Sep 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202609281039 28 Sep 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202609280537 28 Sep 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202609280509 28 Sep 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202609280445 28 Sep 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202609280423 28 Sep 2026 C1 H1 MIT Yes Details →
1.18.33 28 Sep 2026 none MIT — Details →
0.0.0-dev-202609280402 28 Sep 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202609280323 28 Sep 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202609261957 26 Sep 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202609261555 26 Sep 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202609261316 26 Sep 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202609252333 25 Sep 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202609252310 25 Sep 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202609251636 25 Sep 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202609251614 25 Sep 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202609251101 25 Sep 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202609241927 24 Sep 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202609221946 22 Sep 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202609221924 22 Sep 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202609221838 22 Sep 2026 C1 H1 MIT Yes Details →
0.0.0-dev-202609212252 21 Sep 2026 C1 H1 MIT Yes Details →
1.18.32 21 Sep 2026 none MIT — Details →
0.0.0-dev-202609211956 21 Sep 2026 C1 H1 — Yes Details →
0.0.0-dev-202609211937 21 Sep 2026 C1 H1 — Yes Details →
0.0.0-dev-202609211533 21 Sep 2026 C1 H1 — Yes Details →
0.0.0-dev-202609210841 21 Sep 2026 C1 H1 — Yes Details →
0.0.0-dev-202609210803 21 Sep 2026 C1 H1 — Yes Details →
0.0.0-dev-202609210332 21 Sep 2026 C1 H1 — Yes Details →
0.0.0-dev-202609210221 21 Sep 2026 C1 H1 — Yes Details →
0.0.0-dev-202609210202 21 Sep 2026 C1 H1 — Yes Details →
0.0.0-dev-202609210041 21 Sep 2026 C1 H1 — Yes Details →
0.0.0-dev-202609201743 20 Sep 2026 C1 H1 — Yes Details →
0.0.0-dev-202609201705 20 Sep 2026 C1 H1 — Yes Details →
0.0.0-dev-202609201651 20 Sep 2026 C1 H1 — Yes Details →
0.0.0-dev-202609201623 20 Sep 2026 C1 H1 — Yes Details →
0.0.0-dev-202609200100 20 Sep 2026 C1 H1 — Yes Details →
0.0.0-dev-202609200042 20 Sep 2026 C1 H1 — Yes Details →
0.0.0-dev-202609192147 19 Sep 2026 C1 H1 — Yes Details →
0.0.0-dev-202609191432 19 Sep 2026 C1 H1 — Yes Details →
0.0.0-dev-202609190902 19 Sep 2026 C1 H1 — Yes Details →
0.0.0-dev-202609190806 19 Sep 2026 C1 H1 — Yes Details →
0.0.0-dev-202609190751 19 Sep 2026 C1 H1 — Yes Details →

The newest 120 of 12,256 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2026 2

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 2 of the 2 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for opencode-ai

The 2 most severe of 2 vulnerabilities recorded for this package

Search all 2 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2026-22813: OpenCode AI XSS Vulnerability Allows Remote Command Execution 9.4 critical 1.1.10 13 Jan 2026
CVE-2026-22812: OpenCode Unauthenticated HTTP Server Allows Arbitrary Command Execution 8.8 high 1.0.216 13 Jan 2026

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About opencode-ai

Is opencode-ai safe to use?

Vulert records 2 vulnerabilities for opencode-ai in npm: 1 critical, 1 high, 0 medium and 0 low. Every one of them has a published fix, so the practical answer is to run a supported release and keep it patched.

What is opencode-ai's Vulert package health score?

Vulert scores opencode-ai 83/100, which reads as in good shape. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15).

Is the latest version of opencode-ai affected?

No. 1.19.4, the version you would install today, has no vulnerabilities on record against it. Earlier releases do — the version table above lists each release with what affects it.

How many vulnerabilities does opencode-ai have?

2 vulnerabilities are recorded for opencode-ai in the npm ecosystem: 1 critical, 1 high, 0 medium and 0 low. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new opencode-ai vulnerabilities disclosed?

2 vulnerabilities were recorded for opencode-ai in the last 12 months, and the oldest entry in this database dates to 13 Jan 2026. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of opencode-ai are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor opencode-ai for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the opencode-ai version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.