OpenCode Sign-In Flaw Let Malicious MCP Servers Run Code on Windows and WSL

A security flaw in the OpenCode AI coding agent let a malicious or hijacked MCP server execute code on a developer's Windows or WSL machine during sign-in, according to Pillar Security, which found and disclosed the issue on October 19.

OpenCode connects to Model Context Protocol servers to add outside tools, and any code run this way carried the developer's own access. During sign-in, the server supplies the web address the user is sent to - an OAuth authorization endpoint. On Windows and WSL, OpenCode passed that address to a helper that opens it in a browser, building a PowerShell command around it without escaping. An address crafted to carry a PowerShell command would therefore run it. The browser step is only reached when a developer starts sign-in by running opencode mcp auth or making the matching request; having a server configured or opening a session does not trigger it.

Anomaly, the company behind OpenCode, fixed the flaw in version 1.18.33 on September 28. It did not request a CVE or publish a security advisory, so scanners will not flag builds 1.0.137 through 1.18.32. The fix arrived as a routine change: the pull request is described as a refactor of browser-launch code, and neither it nor the release notes mention a security flaw. Pillar reported the issue privately on August 29 and later asked Anomaly to reconsider and request a CVE; according to Pillar, Anomaly said a malicious MCP server falls outside its threat model. Anomaly's security policy states that MCP servers a user configures are outside its trust boundary.

Pillar rates the flaw critical, with a proposed severity score of 9.8 out of 10. The attacker needs control of a remote MCP server the developer has added, and that server need not be hostile from the start - one later taken over, or a domain that changes hands, could carry the same address. macOS and Linux are not affected, because OpenCode opens the browser there without passing the address through a shell.

The underlying browser helper is a widely used package called open. Its Windows behavior was reported as a command-injection risk in 2023 and fixed in open's version 11, but OpenCode stayed on an older release. Checking that an address uses HTTP or HTTPS - the usual defense for this class of bug - does not help, because the attack uses an ordinary HTTPS address. OpenCode added that check too, but the hole was closed by updating to the fixed version.

The same kind of flaw appeared before: in July 2025, the mcp-remote proxy carried an almost identical bug, in which a malicious server's authorization endpoint reached the command line. It was assigned CVE-2025-6514.

Anyone running OpenCode on Windows or WSL should upgrade to 1.18.33 or later. Those who cannot upgrade yet should remove any remote MCP servers they have not vetted from their configuration; running opencode mcp list shows which servers are configured. Pillar reported no signs the flaw has been used in attacks and published no indicators for checking past exploitation. The flaw is separate from a breach of OpenCode's hosted Console disclosed around the same time, which may have exposed some users' stored API keys for OpenAI, Anthropic, and Google.

Source: The Hackers News