/
← Voltar ao feed
high technology software development

OpenCode flaw lets malicious MCP servers run PowerShell code during OAuth sign-in on Windows/WSL; silently fixed in 1.18.33, no CVE

2 fonte(s) · 2 atualização(ões) · publicado 20/10/2026 10:55 · coletado há 1 dia

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 23/10/2026 00:02; os links antigos trazem para cá.

Fontes: thehackernews.com ↗ infosecurity-magazine.com ↗

Pillar Security researcher Eilon Cohen disclosed on October 19, 2026 a critical command-injection flaw in the open-source AI coding agent OpenCode (developed by Anomaly). It affects versions 1.0.137 through 1.18.32 on Windows and WSL. A malicious or hijacked remote MCP server can execute code with the developer's own privileges during MCP OAuth sign-in (infosecurity-magazine.com, thehackernews.com). Pillar reported it privately in late August (August 29 per thehackernews.com), and Anomaly fixed it on September 28 in version 1.18.33 as a routine refactor, with no CVE and no security advisory, so vulnerability scanners and dependency alerts will not flag affected installs. Pillar proposes a CVSS score of 9.8, and neither source reports exploitation in the wild. The flaw is separate from the breach of OpenCode's hosted Console disclosed around the same time.

Entenda a falha

A vulnerabilidade

OpenCode, the AI coding agent from Anomaly, has a command-injection flaw in the browser-launch step of MCP OAuth sign-in on Windows and WSL. The attacker needs control of a remote MCP server the developer has added, which can be hostile from the start or taken over later, for example through a domain that changes hands. The developer must start sign-in (opencode mcp auth or the matching request). Merely configuring the server or opening a session does not trigger it, and no further consent is needed once sign-in starts. The attacker gets code execution with the developer's privileges. Versions 1.0.137 through 1.18.32 are affected and 1.18.33 fixes it. macOS and Linux are not affected. There is no CVE; Pillar Security proposes CVSS 9.8.

Como funciona

During MCP sign-in, the remote server itself supplies the OAuth authorization endpoint URL the user should visit. On Windows and WSL, OpenCode hands that URL to a helper that opens it in the browser. The helper builds a PowerShell command around the URL without escaping it. A URL written to carry a PowerShell command is therefore interpreted as code, not as an address, and it runs. On macOS and Linux the browser is opened without passing the URL through a shell, so the problem does not occur.

Por que é vulnerável

The root cause is unescaped, attacker-influenced input placed into a PowerShell command line. The URL comes from a remote server, yet OpenCode treated it as trusted. The browser helper is the widely used open package, whose Windows command-injection risk was reported in 2023 and fixed in open v11, but OpenCode stayed on an older release. The HTTP/HTTPS scheme check added in 1.18.33 does not stop the attack, because the payload can sit inside an ordinary HTTPS URL. What closed the hole was updating the dependency to a version that quotes the URL correctly. Pillar also recommends argument-based process execution instead of passing untrusted URLs through a shell.

Onde está

The articles name no file or function; they point to OpenCode's browser-launch helper, which relies on the open npm package (versions before 11), and to a pull request described as a refactor of browser-launch code.

Como foi descoberta

Pillar Security, through Eilon Cohen, found the flaw. It reported it privately to Anomaly via GitHub Security Advisory with full reproduction material at the end of August 2026 (August 29 according to The Hacker News), and disclosed it publicly on October 19. Anomaly fixed it on September 28 in 1.18.33 as a routine browser-launch refactor, with no security mention in the pull request or release notes. Pillar later asked Anomaly to request a CVE; according to Pillar, Anomaly replied that a malicious MCP server is outside its threat model, and its policy puts user-configured MCP servers outside its trust boundary. No exploitation in the wild was reported. A near-identical bug hit mcp-remote in July 2025 (CVE-2025-6514).

Explicação gerada por IA a partir da matéria e dos artigos, em 23/10/2026 00:18.

Detalhes técnicos

  • During MCP sign-in the server supplies the OAuth authorization endpoint URL. On Windows and WSL, OpenCode passed it to a browser-launch helper that built a PowerShell command around the URL without escaping, so part of the URL was interpreted as a command (thehackernews.com, infosecurity-magazine.com).
  • The trigger requires the developer to start sign-in (opencode mcp auth or the matching request). Merely configuring the server or opening a session does not reach the vulnerable path, and no further user consent is needed once sign-in starts (thehackernews.com).
  • The attacker needs control of a remote MCP server the developer has added; a server taken over later, or a domain that changes hands, could deliver the payload (thehackernews.com).
  • macOS and Linux are not affected, because the browser is opened without passing the address through a shell (thehackernews.com).
  • The helper is the widely used open package. Its Windows command-injection risk was reported in 2023 and fixed in open v11, but OpenCode stayed on an older release (thehackernews.com).
  • An HTTP/HTTPS scheme check added in 1.18.33 does not stop the attack, since the payload can be embedded in an ordinary HTTPS URL. The crucial fix is updating the dependency to a version that correctly quotes the URL (both sources).
  • A near-identical bug affected the mcp-remote proxy in July 2025 (CVE-2025-6514) (thehackernews.com).
  • Anomaly's security policy treats user-configured MCP servers as outside its trust boundary, and Anomaly said malicious MCP servers are outside its threat model, which is why no CVE was requested (thehackernews.com, infosecurity-magazine.com).
  • The separate Console breach hit a legacy system behind a hosted key proxy and may have exposed provider keys (OpenAI, Anthropic, Google) stored by users. Cohen stressed it is a different target and attacker position (both sources).

Remediação

  • Upgrade OpenCode to 1.18.33 or later, and verify the open dependency is updated to a version that correctly quotes URLs.
  • If you cannot upgrade, remove unvetted remote MCP servers from the configuration; opencode mcp list shows what is configured (thehackernews.com).
  • Do not rely on CVE-based scanners or dependency alerts; check OpenCode versions manually on Windows and WSL hosts.
  • Connect only to trusted MCP servers.
  • Avoid passing untrusted URLs through shell commands; use argument-based process execution to reduce command injection risk (infosecurity-magazine.com).
  • Pillar published no indicators for detecting past exploitation (thehackernews.com).

Relatos divergentes

  • Report date: infosecurity-magazine.com says Pillar reported the issue privately in "late August 2026", while thehackernews.com (more recent) gives the specific date of August 29. The two are consistent.

Linha do tempo

  1. thehackernews.com ↗ · pub. 22/10/2026 07:44 · coletado 22/10 09:00

    OpenCode flaw lets malicious MCP servers run PowerShell code during OAuth sign-in on Windows and WSL; no CVE issued

    ler a análise desta fonte

    A command-injection flaw in the OpenCode AI coding agent (Anomaly) lets a malicious or hijacked remote MCP server execute code on a developer's Windows or WSL machine during OAuth sign-in. The code runs with the developer's own privileges. Pillar Security found the flaw, reported it privately on August 29 and disclosed it on October 19, proposing a severity score of 9.8. Anomaly fixed it in version 1.18.33 on September 28 as a routine refactor, and requested no CVE and published no advisory, so scanners will not flag affected builds (1.0.137 through 1.18.32). Pillar reported no signs of exploitation in the wild.

    Technical Details

    • During MCP sign-in, the server supplies the OAuth authorization endpoint URL. On Windows and WSL, OpenCode passed it to a browser-launch helper that built a PowerShell command around the URL without escaping it, so a crafted address runs arbitrary commands.
    • The trigger requires the developer to start sign-in (opencode mcp auth or the matching request). Merely configuring the server or opening a session does not reach the vulnerable path.
    • The attacker needs control of a remote MCP server the developer has added. A server taken over later, or a domain that changes hands, could deliver the payload.
    • macOS and Linux are not affected, because the browser is opened without passing the address through a shell.
    • The browser helper is the widely used open package. Its Windows command-injection risk was reported in 2023 and fixed in open v11, but OpenCode stayed on an older release. An HTTP/HTTPS scheme check was added but does not stop the attack, since the payload uses an ordinary HTTPS address. Updating the package closed the hole.
    • A near-identical bug affected the mcp-remote proxy in July 2025 (CVE-2025-6514).
    • Anomaly's security policy treats user-configured MCP servers as "outside our trust boundary". Pillar says Anomaly declined to request a CVE on the grounds that a malicious MCP server is outside its threat model.
    • The flaw is separate from a breach of OpenCode's hosted Console disclosed around the same time, which may have exposed some users' stored OpenAI, Anthropic and Google API keys.

    Remediation

    • Upgrade to OpenCode 1.18.33 or later.
    • If you cannot upgrade, remove unvetted remote MCP servers from the OpenCode configuration. Run opencode mcp list to see what is configured.
    • Check the OpenCode version directly on Windows and WSL hosts, since scanners and dependency alerts will not report it.
    • Pillar published no indicators for detecting past exploitation.
  2. infosecurity-magazine.com ↗ · pub. 20/10/2026 10:55 · coletado 20/10 16:31 primeiro registro

    OpenCode silently patched critical RCE in MCP OAuth flow on Windows/WSL (v1.0.137-1.18.32), no CVE issued

    ler a análise desta fonte

    Pillar Security researcher Eilon Cohen disclosed on October 19 a critical remote code execution flaw in the open-source agentic AI coding tool OpenCode (developed by Anomaly), affecting versions 1.0.137 to 1.18.32 on Windows and WSL. A malicious remote MCP server can execute arbitrary code on a developer's machine during the MCP OAuth authentication process, with no additional user interaction or consent. Pillar reported the issue privately in late August 2026. Anomaly said malicious MCP servers were "outside their threat model" but patched it on September 28 in version 1.18.33 without a CVE or security advisory, so vulnerability scanners and dependency alerts will not flag affected installs. Pillar assesses the severity as CVSS 9.8. The article does not report active exploitation. The flaw is unrelated to the recent OpenCode Console breach.

    Technical Details

    • On Windows, the vulnerable open dependency passed the URL to PowerShell without proper escaping, so part of the URL was interpreted as a command.
    • The payload can be embedded in a seemingly legitimate HTTPS URL, so URL scheme validation alone (added in 1.18.33) does not fully prevent the attack.
    • The crucial fix, per Pillar, is updating the dependency to a version that correctly quotes the URL.
    • The separate Console breach hit a legacy system behind a hosted key proxy and exposed provider keys stored by users. Cohen stressed it is a different target and attacker position.

    Remediation

    • Upgrade OpenCode to 1.18.33 or later and verify that the open dependency is updated to a version that correctly quotes URLs.
    • Do not rely on CVE-based scanners to identify affected installs; inventory OpenCode versions manually.
    • Connect only to trusted MCP servers.
    • Developers should avoid passing untrusted URLs through shell commands and use argument-based process execution instead to reduce command injection risk.