OpenCode MCP sign-in flaw executes code on Windows and WSL
Original title: OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL
Builds 1.0.137 through 1.18.32 are affected; Anomaly fixed it in 1.18.33 without a CVE or advisory.
Pillar Security says a malicious or later-hijacked MCP server could run PowerShell as the developer when OpenCode started an MCP sign-in on Windows or WSL. The OAuth authorization URL was passed unsanitized to a browser helper. Anomaly fixed it in OpenCode 1.18.33 on September 28 but did not request a CVE. Pillar reported no signs of exploitation. macOS and Linux are not affected.
Unconfirmed: Pillar's 9.8 score is proposed, and Anomaly says a malicious MCP server is outside its threat model.
- The bug triggers only from opencode mcp auth or the matching sign-in request.
- Pillar disclosed it on October 19 and proposes a 9.8 score.
- OpenCode stayed on an old open package whose Windows injection was fixed in version 11.
- A separate Console breach may have exposed stored OpenAI, Anthropic, and Google API keys.
Impact: Code execution with the developer's privileges on Windows or WSL
| Product | Affected | Fixed in |
|---|---|---|
| Anomaly OpenCode | 1.0.137 through 1.18.32 | 1.18.33 |
- 1.Upgrade OpenCode on Windows or WSL to 1.18.33 or later.
- 2.Remove unvetted remote MCP servers if you cannot upgrade.
- 3.Run opencode mcp list to see configured servers.
- ATT&CK
- T1059.001 PowerShell
- Vendors
- Anomaly
- Products
- OpenCode
- Organizations
- Pillar Security
From the original article
3 min read at thehackernews.com
A flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer's Windows or WSL machine when the developer signed in. OpenCode connects to MCP (Model Context Protocol) servers to add outside tools, and such code would run with the developer's own access. Anomaly, the company behind OpenCode, fixed the flaw in version 1.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.