OpenCode flaw lets malicious MCP servers run PowerShell code during OAuth sign-in on Windows and WSL; no CVE issued
A command-injection flaw in the OpenCode AI coding agent (Anomaly) lets a malicious or hijacked remote MCP server execute code on a developer's Windows or WSL machine during OAuth sign-in. The code runs with the developer's own privileges. Pillar Security found the flaw, reported it privately on August 29 and disclosed it on October 19, proposing a severity score of 9.8. Anomaly fixed it in version 1.18.33 on September 28 as a routine refactor, and requested no CVE and published no advisory, so scanners will not flag affected builds (1.0.137 through 1.18.32). Pillar reported no signs of exploitation in the wild.
Entenda a falha
A vulnerabilidade
OpenCode, the AI coding agent from Anomaly, has a command-injection flaw in the browser-launch step of MCP OAuth sign-in on Windows and WSL. A malicious or later-hijacked remote MCP server that the developer added can supply an authorization URL that runs PowerShell commands with the developer's privileges. The developer must start sign-in (opencode mcp auth or the matching request); merely configuring the server or opening a session does not trigger it. Versions 1.0.137 through 1.18.32 are affected and 1.18.33 fixes it. macOS and Linux are not affected. No CVE was issued; Pillar Security proposes a severity of 9.8.
Como funciona
During MCP sign-in, the remote server itself tells OpenCode which OAuth authorization endpoint URL the user should visit. On Windows and WSL, OpenCode passes that URL to a helper that opens it in the browser. The helper builds a PowerShell command around the URL without escaping it. A URL written to carry a PowerShell command is therefore interpreted as code instead of being treated as an address. On macOS and Linux the browser is opened without passing the URL through a shell, so the problem does not occur.
Por que é vulnerável
The root cause is unescaped, attacker-influenced input being placed into a PowerShell command line. The URL comes from a remote server, but OpenCode treated it as trusted. The browser helper is the widely used open package, whose Windows command-injection risk was reported in 2023 and fixed in open v11, yet OpenCode stayed on an older release. An HTTP/HTTPS scheme check was added but does not stop the attack, since the payload is an ordinary HTTPS address. Updating the package to the fixed version closed the hole.
Onde está
The articles name no file or function; they point to OpenCode's browser-launch helper, which relies on the open npm package (versions before 11), and to a pull request described as a refactor of browser-launch code.
Como foi descoberta
Pillar Security found the flaw and reported it privately to Anomaly on August 29, then disclosed it on October 19. Anomaly fixed it in 1.18.33 on September 28 as a routine browser-launch refactor, with no mention of security in the pull request or release notes. Pillar later asked Anomaly to request a CVE; according to Pillar, Anomaly replied that a malicious MCP server is outside its threat model, and its policy calls user-configured MCP servers outside its trust boundary. Pillar reported no exploitation in the wild. A near-identical bug affected mcp-remote in July 2025 (CVE-2025-6514).
Explicação gerada por IA a partir da matéria e dos artigos, em 22/10/2026 09:16.
Detalhes técnicos
- During MCP sign-in, the server supplies the OAuth authorization endpoint URL. On Windows and WSL, OpenCode passed it to a browser-launch helper that built a PowerShell command around the URL without escaping it, so a crafted address runs arbitrary commands.
- The trigger requires the developer to start sign-in (
opencode mcp author the matching request). Merely configuring the server or opening a session does not reach the vulnerable path. - The attacker needs control of a remote MCP server the developer has added. A server taken over later, or a domain that changes hands, could deliver the payload.
- macOS and Linux are not affected, because the browser is opened without passing the address through a shell.
- The browser helper is the widely used open package. Its Windows command-injection risk was reported in 2023 and fixed in open v11, but OpenCode stayed on an older release. An HTTP/HTTPS scheme check was added but does not stop the attack, since the payload uses an ordinary HTTPS address. Updating the package closed the hole.
- A near-identical bug affected the mcp-remote proxy in July 2025 (CVE-2025-6514).
- Anomaly's security policy treats user-configured MCP servers as "outside our trust boundary". Pillar says Anomaly declined to request a CVE on the grounds that a malicious MCP server is outside its threat model.
- The flaw is separate from a breach of OpenCode's hosted Console disclosed around the same time, which may have exposed some users' stored OpenAI, Anthropic and Google API keys.
Remediação
- Upgrade to OpenCode 1.18.33 or later.
- If you cannot upgrade, remove unvetted remote MCP servers from the OpenCode configuration. Run
opencode mcp listto see what is configured. - Check the OpenCode version directly on Windows and WSL hosts, since scanners and dependency alerts will not report it.
- Pillar published no indicators for detecting past exploitation.
Linha do tempo
-
OpenCode flaw lets malicious MCP servers run PowerShell code during OAuth sign-in on Windows and WSL; no CVE issued
ler a análise desta fonte ocultar
A command-injection flaw in the OpenCode AI coding agent (Anomaly) lets a malicious or hijacked remote MCP server execute code on a developer's Windows or WSL machine during OAuth sign-in. The code runs with the developer's own privileges. Pillar Security found the flaw, reported it privately on August 29 and disclosed it on October 19, proposing a severity score of 9.8. Anomaly fixed it in version 1.18.33 on September 28 as a routine refactor, and requested no CVE and published no advisory, so scanners will not flag affected builds (1.0.137 through 1.18.32). Pillar reported no signs of exploitation in the wild.
Technical Details
- During MCP sign-in, the server supplies the OAuth authorization endpoint URL. On Windows and WSL, OpenCode passed it to a browser-launch helper that built a PowerShell command around the URL without escaping it, so a crafted address runs arbitrary commands.
- The trigger requires the developer to start sign-in (
opencode mcp author the matching request). Merely configuring the server or opening a session does not reach the vulnerable path. - The attacker needs control of a remote MCP server the developer has added. A server taken over later, or a domain that changes hands, could deliver the payload.
- macOS and Linux are not affected, because the browser is opened without passing the address through a shell.
- The browser helper is the widely used open package. Its Windows command-injection risk was reported in 2023 and fixed in open v11, but OpenCode stayed on an older release. An HTTP/HTTPS scheme check was added but does not stop the attack, since the payload uses an ordinary HTTPS address. Updating the package closed the hole.
- A near-identical bug affected the mcp-remote proxy in July 2025 (CVE-2025-6514).
- Anomaly's security policy treats user-configured MCP servers as "outside our trust boundary". Pillar says Anomaly declined to request a CVE on the grounds that a malicious MCP server is outside its threat model.
- The flaw is separate from a breach of OpenCode's hosted Console disclosed around the same time, which may have exposed some users' stored OpenAI, Anthropic and Google API keys.
Remediation
- Upgrade to OpenCode 1.18.33 or later.
- If you cannot upgrade, remove unvetted remote MCP servers from the OpenCode configuration. Run
opencode mcp listto see what is configured. - Check the OpenCode version directly on Windows and WSL hosts, since scanners and dependency alerts will not report it.
- Pillar published no indicators for detecting past exploitation.