OpenCode 1.0.137–1.18.32 RCE silently fixed in 1.18.33
Original title: Researchers Warn OpenCode Quietly Patched Critical RCE Flaw, Leaving Users At Risk
Pillar Security says a malicious MCP server can run code on Windows during OAuth, and scanners will not flag the flaw.
Pillar Security says OpenCode versions 1.0.137 to 1.18.32 let an attacker-controlled remote MCP server run arbitrary code on a developer machine during MCP OAuth, on Windows and WSL, without further consent. Anomaly patched it on September 28 in 1.18.33 without a CVE or advisory after calling malicious MCP servers outside its threat model. Researchers rate it CVSS 9.8 and say URL-scheme checks are insufficient unless the dependency correctly quotes the URL before PowerShell. Pillar says the issue is unrelated to OpenCode’s recent Console breach.
Unconfirmed: The CVSS 9.8 rating is Pillar Security’s assessment; no CVE was assigned and exploitation is not reported.
- OpenCode has more than 218,000 GitHub stars.
- Pillar reported it privately in late August 2026 with reproduction material.
- On Windows, an unescaped URL was passed to PowerShell and interpreted as a command.
- Researchers say the essential fix was quoting the URL in the updated dependency.
- The separate Console breach exposed stored provider keys on a legacy hosted proxy.
Impact: Arbitrary code execution on a developer machine
| Product | Affected | Fixed in |
|---|---|---|
| Anomaly OpenCode | 1.0.137 to 1.18.32 | 1.18.33 |
- 1.Upgrade OpenCode to 1.18.33 or later, since no CVE or advisory was issued.
- 2.Avoid passing untrusted URLs through shell commands; use argument-based process execution.
- ATT&CK
- T1059.001 PowerShell
- Vendors
- Anomaly
- Products
- OpenCode
- Organizations
- Pillar Security
From the original article
2 min read at infosecurity-magazine.com
OpenCode silently patched a critical RCE flaw, leaving vulnerable users unaware of the security risk, researchers at Pillar Security warned
By Kevin Poireault · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.