high technology software development

OpenCode silently patched critical RCE in MCP OAuth flow on Windows/WSL (v1.0.137-1.18.32), no CVE issued

1 fonte(s) · 1 atualização(ões) · publicado 20/10/2026 10:55 · coletado há 5 horas

Pillar Security researcher Eilon Cohen disclosed on October 19 a critical remote code execution flaw in the open-source agentic AI coding tool OpenCode (developed by Anomaly), affecting versions 1.0.137 to 1.18.32 on Windows and WSL. A malicious remote MCP server can execute arbitrary code on a developer's machine during the MCP OAuth authentication process, with no additional user interaction or consent. Pillar reported the issue privately in late August 2026. Anomaly said malicious MCP servers were "outside their threat model" but patched it on September 28 in version 1.18.33 without a CVE or security advisory, so vulnerability scanners and dependency alerts will not flag affected installs. Pillar assesses the severity as CVSS 9.8. The article does not report active exploitation. The flaw is unrelated to the recent OpenCode Console breach.

Technical Details

On Windows, the vulnerable open dependency passed the URL to PowerShell without proper escaping, so part of the URL was interpreted as a command.
The payload can be embedded in a seemingly legitimate HTTPS URL, so URL scheme validation alone (added in 1.18.33) does not fully prevent the attack.
The crucial fix, per Pillar, is updating the dependency to a version that correctly quotes the URL.
The separate Console breach hit a legacy system behind a hosted key proxy and exposed provider keys stored by users. Cohen stressed it is a different target and attacker position.

Remediation

Upgrade OpenCode to 1.18.33 or later and verify that the open dependency is updated to a version that correctly quotes URLs.
Do not rely on CVE-based scanners to identify affected installs; inventory OpenCode versions manually.
Connect only to trusted MCP servers.
Developers should avoid passing untrusted URLs through shell commands and use argument-based process execution instead to reduce command injection risk.

Linha do tempo

infosecurity-magazine.com ↗ · pub. 20/10/2026 10:55 · coletado 20/10 16:31 primeiro registro

OpenCode silently patched critical RCE in MCP OAuth flow on Windows/WSL (v1.0.137-1.18.32), no CVE issued
ler a análise desta fonte ocultar
Pillar Security researcher Eilon Cohen disclosed on October 19 a critical remote code execution flaw in the open-source agentic AI coding tool OpenCode (developed by Anomaly), affecting versions 1.0.137 to 1.18.32 on Windows and WSL. A malicious remote MCP server can execute arbitrary code on a developer's machine during the MCP OAuth authentication process, with no additional user interaction or consent. Pillar reported the issue privately in late August 2026. Anomaly said malicious MCP servers were "outside their threat model" but patched it on September 28 in version 1.18.33 without a CVE or security advisory, so vulnerability scanners and dependency alerts will not flag affected installs. Pillar assesses the severity as CVSS 9.8. The article does not report active exploitation. The flaw is unrelated to the recent OpenCode Console breach.

Technical Details
- On Windows, the vulnerable open dependency passed the URL to PowerShell without proper escaping, so part of the URL was interpreted as a command.
- The payload can be embedded in a seemingly legitimate HTTPS URL, so URL scheme validation alone (added in 1.18.33) does not fully prevent the attack.
- The crucial fix, per Pillar, is updating the dependency to a version that correctly quotes the URL.
- The separate Console breach hit a legacy system behind a hosted key proxy and exposed provider keys stored by users. Cohen stressed it is a different target and attacker position.
Remediation
- Upgrade OpenCode to 1.18.33 or later and verify that the open dependency is updated to a version that correctly quotes URLs.
- Do not rely on CVE-based scanners to identify affected installs; inventory OpenCode versions manually.
- Connect only to trusted MCP servers.
- Developers should avoid passing untrusted URLs through shell commands and use argument-based process execution instead to reduce command injection risk.