OpenCode Code Execution Flaw in MCP Server Sign-In on Windows

A flaw in the OpenCode AI coding agent allowed attackers to execute arbitrary code on a developer's Windows or WSL machine when the user signed in to a malicious or hijacked Model Context Protocol server. The code ran with the developer's own access privileges, granting the attacker the same level of control as the user. This incident highlights the risks of integrating external tools into development environments without strict validation.

How it unfolded

• On August 29, security firm Pillar Security privately reported the vulnerability to Anomaly, the company behind OpenCode.
• On September 28, Anomaly released version 1.18.33, which fixed the flaw as part of a routine refactor of browser-launch code.
• On October 19, Pillar Security publicly disclosed the issue, noting that Anomaly declined to request a CVE or issue an advisory.

Who is affected

The vulnerability impacts OpenCode installations on Windows and the Windows Subsystem for Linux. Versions 1.0.137 through 1.18.32 are at risk. macOS and Linux versions are not affected because they open browsers without passing addresses through a shell. An attacker needs control of a remote MCP server that the developer has added, which could be a server initially trusted but later compromised.

The fix

Anomaly addressed the issue in OpenCode version 1.18.33. The update corrected the way the application handles OAuth authorization endpoints on Windows. However, because Anomaly did not request a CVE identifier or publish a formal security advisory, automated vulnerability scanners will not flag affected builds. Users must manually check their OpenCode version to determine if they are running a vulnerable release.

What made it possible

Teams should recognize that integrating third-party services into local development tools expands the attack surface significantly. When applications pass user-supplied data to system shells without proper escaping, they create opportunities for command injection. This technique allows an attacker to hijack the execution context of the host machine. Security teams usually audit how applications handle external URLs and ensure that no user-controlled input reaches a shell interpreter directly.

What to do and how to stay safe: OpenCode

• Verify that your OpenCode installation is updated to version 1.18.33 or later to mitigate this specific code execution risk.
• Review the list of configured MCP servers and remove any that are no longer needed or whose trustworthiness is uncertain.
• Monitor for signs of unauthorized command execution on Windows and WSL environments, especially during authentication events.
• Educate developers on the risks of connecting to external servers and ensure they understand the trust boundaries of their tools.

Step-by-step guide: What Is Virtual Patching: How It Works Without Code Changes

General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is there a CVE for this OpenCode vulnerability?

No, Anomaly did not request a CVE or publish a security advisory for this flaw, so it will not appear in vulnerability scanners.

Which operating systems are affected by this issue?

The flaw affects OpenCode on Windows and the Windows Subsystem for Linux; macOS and Linux versions are not impacted.

How did the attacker execute code on the victim's machine?

The attacker supplied a malicious OAuth authorization endpoint that was passed to a PowerShell helper without escaping, allowing command execution.