[critical] OpenCode: malicious MCP server can run code on Windows/WSL during sign-in (no CVE)

Fri, 23 Oct 2026 01:55:38 GMT

A command-injection flaw in the OpenCode AI coding agent let a malicious or later-hijacked remote MCP server run PowerShell commands on a developer's Windows or WSL machine when they started the MCP OAuth sign-in. The server-supplied authorization endpoint was passed unescaped to an old version of the open package. Anomaly fixed it in 1.18.33 on Sep 28 without a CVE or advisory, so scanners won't flag 1.0.137 through 1.18.32. macOS and Linux are not affected. Pillar Security found it and rates it 9.8; no in-the-wild exploitation reported.

Status: live · Patch: patched · Fixed in: OpenCode 1.18.33

Latest updates:

2026-10-22: The Hacker News reports the flaw; upgrade to 1.18.33, run `opencode mcp list`, and remove unvetted remote MCP servers. (source)
2026-10-19: Pillar Security discloses the flaw publicly. Anomaly declined to request a CVE, saying user-configured MCP servers are outside its trust boundary. (source)
2026-09-28: OpenCode 1.18.33 ships the fix as a routine browser-launch refactor; release notes don't mention security. (source)

[high] BerriAI LiteLLM: BerriAI LiteLLM Improper Authentication Vulnerability

Wed, 02 Sep 2026 00:00:00 GMT

BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token. Added to CISA KEV on 2026-09-02.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-09-02: CISA added CVE-2026-59822 to the KEV catalog (due 2026-09-16).

CVEs: CVE-2026-59822

pwn.watch: MCP incident updates

[critical] OpenCode: malicious MCP server can run code on Windows/WSL during sign-in (no CVE)

[high] BerriAI LiteLLM: BerriAI LiteLLM Improper Authentication Vulnerability