OpenCode has addressed a security vulnerability in its AI coding agent that could allow a malicious or compromised MCP (Model Context Protocol) server to execute code on a developer’s Windows or Windows Subsystem for Linux (WSL) environment during the sign in process. The flaw was discovered by security firm Pillar Security and was fixed in OpenCode version 1.18.33 released on September 28. OpenCode uses MCP servers to connect external tools and services, allowing developers to extend the capabilities of the AI coding agent. However, researchers found that a compromised MCP server could potentially use the developer’s own access privileges to execute unauthorized commands during authentication. The vulnerability affected OpenCode versions from 1.0.137 through 1.18.32, while newer releases include the security fix.
The issue occurred during the OAuth sign in process when OpenCode received an authorization endpoint address from an MCP server. On Windows and WSL environments, OpenCode passed the supplied web address to a browser opening helper without properly escaping the address before creating a PowerShell command. Researchers found that a specially crafted address could cause unintended command execution through the PowerShell process. The vulnerability required a developer to initiate the MCP authentication process by running a sign in command or making the related request. Simply having a configured MCP server or opening a normal session would not trigger the issue. Researchers explained that an attacker would need control over an MCP server configured by the developer, either through a deliberately malicious server or through a legitimate server that was later compromised or transferred to another owner.
Pillar Security, which identified and responsibly disclosed the vulnerability on October 19, rated the issue as critical and proposed a severity score of 9.8 out of 10. The vulnerability specifically affected OpenCode installations running on Windows and WSL, while macOS and Linux systems were not impacted because the browser opening process works differently on those platforms. OpenCode included the fix as part of a regular update, but the associated code change was described as a browser launch refactor and did not specifically mention the security issue in release notes. The company did not request a CVE identifier or publish a dedicated security advisory for this vulnerability. According to Pillar, Anomaly considered MCP servers configured by users to be outside its security trust boundary, although researchers encouraged further consideration of the issue due to the potential impact on developer environments.
Security researchers noted that this type of vulnerability has appeared in other MCP related tools before. In 2025, a similar issue was identified in the mcp remote proxy, where a malicious server’s authorization endpoint could reach the command line and was assigned CVE 2025 6514. Researchers also pointed out that OpenCode relied on an older version of a browser launching package that had previously faced command injection concerns on Windows. To address the current issue, OpenCode users are advised to upgrade to version 1.18.33 or later and review their connected MCP servers. Users who cannot immediately update should remove remote MCP servers that have not been properly reviewed and use OpenCode’s server listing command to check configured connections. Pillar Security said it found no evidence that the vulnerability had been exploited in active attacks and noted that the issue is separate from a separate OpenCode Console security incident disclosed around the same period.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
