Your AI coding agent might have executed an attacker's command just because you tried to log in, because a flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer's Windows or WSL machine, and it did so without a CVE or any public warning, which means standard vulnerability scanners will completely miss it.

OpenCode connects to Model Context Protocol servers to add outside tools, and the code runs with the developer's own access, so a compromised server inherits your permissions.

Anomaly, the company behind OpenCode, fixed the flaw in version 1.18.33 on September 28. They did not request a CVE or publish a security advisory.

What Makes the OpenCode Vulnerability So Dangerous

The flaw triggers during the sign-in process, when the server itself supplies the web address the user is sent to, which is the OAuth authorization endpoint.

On Windows and WSL, OpenCode handed that address to a helper that opens it in a browser, but the helper built a PowerShell command around the address without escaping it, so an address written to carry a PowerShell command would run that command.

The browser step runs only when a developer starts the sign-in, by running opencode mcp auth or making the matching request. Simply having the server configured, or opening a session, does not reach it.

The attacker needs control of a remote MCP server the developer has added, but that server doesn't have to be hostile from the start, because a legitimate server that is later taken over, or a domain that changes hands, could carry the same malicious address.

The Silent Patch Problem

OpenCode shipped the fix as a routine change, and the pull request that carried it is described as a refactor of browser-launch code. Neither the pull request nor the release notes mention a security flaw.

Pillar Security, which found the flaw and disclosed it on October 19, rates it critical, with a proposed severity score of 9.8 out of 10.

Pillar reported the flaw privately on August 29 and later asked Anomaly to reconsider and request a CVE, but Anomaly's answer was that a malicious MCP server falls outside its threat model, because its security policy says MCP servers that a user configures are outside their trust boundary.

Because there is no CVE, the flaw will not show up in scanners or dependency alerts, so finding affected installs means checking the OpenCode version directly.

A Familiar Flaw With a Familiar Package

The same kind of flaw has surfaced before, because in July 2025, the mcp-remote proxy carried an almost identical bug, in which a malicious server's authorization endpoint reached the command line, and that one was assigned CVE-2025-6514.

The core issue here lives in OpenCode's browser helper, which is a widely used package called open. Its Windows behavior was reported as a command-injection risk in 2023 and fixed in open's version 11, but OpenCode stayed on an older release.

The usual defense for this class of flaw is to check that the address uses HTTP or HTTPS, but that does not help here, because the attack uses an ordinary HTTPS address, and while OpenCode added that check as well, the hole was only truly closed by updating the package to the fixed version.

How to Protect Your Development Environment

Anyone running OpenCode on Windows or WSL should upgrade and check which servers they are connected to.

• Upgrade to OpenCode 1.18.33 or later. This is the only way to fully close the hole.
• Remove unvetted MCP servers. If you cannot upgrade yet, remove any remote MCP servers you have not vetted from your OpenCode configuration.
• Audit your connections. Run opencode mcp list to see exactly which servers are currently configured.

Pillar reported no signs that the flaw has been used in attacks and published no indicators to check for past exploitation.

This flaw is also separate from a breach of OpenCode's hosted Console disclosed around the same time, which may have exposed some users' stored API keys for OpenAI, Anthropic, and Google.

FAQ

What is the OpenCode vulnerability?

It is a command-injection flaw in OpenCode versions 1.0.137 through 1.18.32 on Windows and WSL. A malicious MCP server can supply a crafted OAuth authorization endpoint that executes PowerShell commands when a developer signs in.

Why was no CVE assigned to this flaw?

Anomaly, the company behind OpenCode, stated that malicious MCP servers fall outside its trust boundary and threat model, so it did not request a CVE or publish a security advisory.

Does this affect macOS or Linux users?

No. OpenCode opens the browser on macOS and Linux without passing the address through a shell, so those platforms are not vulnerable.

How do I know if my OpenCode installation is vulnerable?

You have to check the version manually, because the lack of a CVE means vulnerability scanners will not flag it. If you are running a version between 1.0.137 and 1.18.32 on Windows or WSL, you are affected.

What should I do if I can't upgrade immediately?

If you cannot upgrade to 1.18.33 right away, you should remove any remote MCP servers you have not thoroughly vetted, and run opencode mcp list to review your current configurations.

Source: The Hacker News