OpenCode: malicious MCP server can run code on Windows/WSL during sign-in (no CVE)
› OpenCode AI coding agent (Anomaly) on Windows and WSL
Get an email when a new major security incident drops. No spam, unsubscribe any time.
- started
- Oct 19, 2026
- closed
- ongoing
- CVEs
- none
- sources
- 3
## summary
A command-injection flaw in the OpenCode AI coding agent let a malicious or later-hijacked remote MCP server run PowerShell commands on a developer's Windows or WSL machine when they started the MCP OAuth sign-in. The server-supplied authorization endpoint was passed unescaped to an old version of the open package. Anomaly fixed it in 1.18.33 on Sep 28 without a CVE or advisory, so scanners won't flag 1.0.137 through 1.18.32. macOS and Linux are not affected. Pillar Security found it and rates it 9.8; no in-the-wild exploitation reported.
severity: Proposed CVSS 9.8 (Pillar Security); no CVE assigned; no known exploitation
## affected
- OpenCode 1.0.137 through 1.18.32 on Windows and WSL
## fixed in
- OpenCode 1.18.33
## timeline[4]
The Hacker News reports the flaw; upgrade to 1.18.33, run `opencode mcp list`, and remove unvetted remote MCP servers.
sourcePillar Security discloses the flaw publicly. Anomaly declined to request a CVE, saying user-configured MCP servers are outside its trust boundary.
sourceOpenCode 1.18.33 ships the fix as a routine browser-launch refactor; release notes don't mention security.
sourcePillar Security privately reports the flaw to Anomaly.
source
## news & write-ups[2]
## posts[1]
🚨 OpenCode flaw lets malicious MCP servers execute code on Windows and WSL when developers initiate sign-in. Fixed in v1.18.33, but there's no CVE or security advisory. Vulnerability scanners won't flag affected versions. What developers need to know: t.co/l6N4LCjhWt
## notes & caveats
Facts from The Hacker News and Pillar Security's X post; Pillar's full write-up URL not yet captured. Separate from the OpenCode Console provider-key breach. No CVE, so version checks must be done by hand.
