Published
- 4 min read
By Allan D - Editor, AI Security Wire
OpenCode Silently Patched an MCP OAuth Flaw That Ran Code on Windows
Pillar Security has published details of a remote code execution bug in OpenCode, which it rates critical (proposed CVSS 9.8, not an NVD or vendor score), the open-source AI coding agent. The flaw was fixed weeks ago, with no public notice. Anomaly, the company behind OpenCode, shipped the patch in version 1.18.33 on September 28 with no CVE and no public advisory that we could find as of October 20 (checked in NVD, the CISA KEV feed and the project’s GitHub advisories). Pillar says the release notes do not mention security either, and the v1.18.33 release notes we checked agree.
This is a separate problem from the console breach we covered earlier in the week: OpenCode Breach Ties API Key Theft to Large-Scale Distillation Attack. Pillar’s researcher says the two are unrelated.
How the Attack Works
The bug sits in the MCP OAuth flow. When OpenCode connects to a remote MCP server that needs authentication, it reads an authorization_endpoint value from the server’s OAuth discovery document and opens it in the browser. Pillar says that value passes through the MCP SDK and OpenCode’s own code without being sanitised, then lands in the open npm package.
On Windows, open 10.1.2 launches the target through PowerShell with the URL placed inside a double-quoted string. PowerShell expands $(...) inside double quotes. So a URL that looks like an ordinary web link can carry a command that runs the moment OpenCode tries to open it.
That detail matters for defenders. The MCP TypeScript SDK blocks javascript:, data: and vbscript: schemes, but not ordinary https URLs. Pillar’s conclusion is that scheme validation alone can’t stop this one, because the payload is a perfectly valid web URL.
There is no user step beyond connecting to the server. No prompt injection and no malicious package. The server also doesn’t have to be hostile when the developer adds it. A later compromise, a typosquatted name or a lapsed domain would do.
Affected Versions and the Fix
Pillar lists OpenCode 1.0.137 through 1.18.32 as vulnerable, on Windows and WSL. macOS and Linux aren’t affected. We checked the npm registry: 1.18.32 was published on September 21 and 1.18.33 on September 28, which matches Pillar’s account. The fix bumped open to 11.0.4, and Pillar calls 11.0.4 the true complete fix: it wraps the target in single quotes, which PowerShell does not expand. Pillar says open 11.0.0 fixed argument escaping.
The pull request that closed the hole is titled “refactor(core): share a browser opener across opencode and tui.” Nothing in that title says security, which fits Pillar’s claim that the fix landed as a refactor.
The Disclosure Dispute
Per Pillar’s timeline, it reported the bug privately through a GitHub Security Advisory on August 29. After a follow-up on September 25, Anomaly confirmed receipt and said that dealing with a malicious MCP server is “outside our threat model.” The same day, Pillar says it set out the distinction from prompt injection, asked Anomaly to reconsider and request a CVE, and said it intended to publish. The patch merged that day, and version 1.18.33 shipped on the 28th.
One wrinkle: Pillar’s page is dated October 19, but its own timeline lists the report’s publication as October 4. We couldn’t resolve that discrepancy, so treat the exact publication date with some caution. Infosecurity Magazine reported the story on October 20.
What to Do
Upgrade to OpenCode 1.18.33 or later. If you’re on Windows or WSL and can’t upgrade yet, remove any remote MCP servers you haven’t vetted.
Security teams should inventory OpenCode installs directly. With no CVE, standard scanners and dependency bots may not flag this. Pillar also points builders of MCP clients to the same fix pattern: pass arguments as an argv array instead of a command line, and bind OAuth discovery to the configured origin.
This sink isn’t new. Pillar links it to earlier command injection bugs in mcp-remote and other tools that feed untrusted URLs to the same function. The open maintainer’s position, quoted by Pillar, is that the package makes no security guarantees. The two CVEs published in OpenCode’s GitHub advisories this year, CVE-2026-22812 and CVE-2026-22813, are different bugs. Anyone passing remote strings to it is carrying that risk themselves.
References
Frequently Asked Questions
- Which OpenCode versions are affected and who is at risk?
- Pillar Security lists opencode versions 1.0.137 through 1.18.32 as affected, on Windows and WSL only. The researchers say macOS and Linux are not affected. Version 1.18.33, published to npm on September 28, 2026, contains the fix.
- Is there a CVE for this OpenCode vulnerability?
- No evidence of one was found as of October 20, 2026 in NVD, the CISA KEV feed or the project's published GitHub advisories. The 9.8 Critical score is a proposed CVSS v3.1 rating in Pillar Security's post, not an official vendor or NVD score. Because there is no CVE, standard dependency scanners may not flag vulnerable installs.
- Does the attacker need to trick the developer into anything?
- According to Pillar, no prompt injection, extra click or malicious package is needed. The developer only has to connect OpenCode to a remote MCP server that the attacker controls. That server does not have to be hostile on day one, since a compromise, typosquat or expired domain could turn a trusted server into the delivery point later.
- Is this related to the OpenCode console breach reported earlier this week?
- No. Pillar's researcher said the flaw is unrelated to the console breach that exposed stored provider API keys. That incident hit a legacy hosted system. This one is a client-side command injection bug in the open-source coding agent.