OpenCode flaw let MCP sign-in trigger Windows code execution
The OpenCode flaw allowed a malicious or compromised Model Context Protocol (MCP) server, an outside service that supplies tools to an AI coding agent, to execute code when a developer began signing in on Windows or the Windows Subsystem for Linux (WSL). The resulting commands ran with the developer's own access, making the weakness especially important on workstations used to manage software, websites or infrastructure.
Anomaly, the company behind OpenCode, corrected the problem in version 1.18.33 on September 28. Versions 1.0.137 through 1.18.32 are affected. Because Anomaly did not request a CVE, the standard identifier commonly assigned to publicly tracked security flaws, or issue a security advisory, vulnerability scanners and dependency alerts will not identify installations that remain exposed. Administrators must check the installed OpenCode version directly.
The vulnerable path began during an MCP sign-in. The remote server supplied an OAuth authorization endpoint, which is the web address used to start a permission-based login process. On Windows and WSL, OpenCode sent that address to a browser-opening helper. That helper constructed a PowerShell command around the address without safely escaping its contents. PowerShell is a Windows tool for running commands and administrative scripts. A specially prepared address could therefore inject and execute a command rather than merely open the intended page.
The behavior was not triggered simply by configuring an MCP server or opening an OpenCode session. A developer had to start the authentication process by running opencode mcp auth or making the equivalent request. The attacker also needed control of a remote MCP server already added by the developer. That server did not have to be malicious when first configured. Pillar Security warned that a previously legitimate server could later be compromised, or its domain could change ownership, creating the same risk when a user next attempted to sign in.
Pillar Security found the vulnerability, privately reported it on August 29 and disclosed it on October 19. The company rated it critical and proposed a severity score of 9.8 out of 10. It reported no evidence that attackers had exploited the flaw and published no indicators that administrators could use to search for earlier abuse. The weakness affects Windows and WSL because of how the browser helper handled the address on those platforms. macOS and Linux are not affected because the address is opened there without being passed through a command shell.
The fix arrived without being described as a security update. The pull request containing it was presented as a refactoring of browser-launch code, while the release notes did not mention a vulnerability. Anomaly's security policy places user-configured MCP servers outside its trust boundary. According to Pillar Security, Anomaly maintained that a malicious MCP server was outside its threat model after Pillar asked the company to reconsider and obtain a CVE. Anomaly has published advisories for other OpenCode code-execution vulnerabilities, including one fixed in August.
The underlying browser helper is a widely used package named open. Its Windows behavior was reported as a command-injection risk in 2023, and the package corrected the issue in version 11. OpenCode had continued to use an older release. Although checking that an authorization address begins with HTTP or HTTPS is a common defense, that check alone would not prevent this attack because the malicious input could be carried in a normal HTTPS address. OpenCode added such a check, but updating to the corrected release of open was the change that removed the vulnerable command handling.
A closely related problem appeared in July 2025 in the mcp-remote proxy. That flaw, tracked as CVE-2025-6514, also allowed a malicious server's authorization endpoint to reach a command line. The earlier case shows that authentication addresses supplied by remote tool servers can become a code-execution route when applications pass them through a shell without safe handling.
Windows and WSL users should upgrade to OpenCode 1.18.33 or later and run opencode mcp list to review configured servers. Anyone unable to update immediately should remove remote MCP servers they have not vetted and avoid initiating authentication with them. Since scanners are not expected to flag the affected OpenCode releases, organisations should not rely solely on automated vulnerability notifications for this issue.
For teams that need support managing developer tools and third-party integrations, AEU-I offers security-first IT, infrastructure and consulting. This OpenCode vulnerability is separate from a breach of the hosted OpenCode Console disclosed around the same period, which may have exposed some users' stored API keys for OpenAI, Anthropic and Google.