A security vulnerability in the OpenCode AI coding agent has been discovered, which allows unauthorized code execution on Windows and WSL systems. This flaw occurs when a developer logs into a malicious or compromised MCP server, potentially granting server control to execute code under the developer’s own privileges.
Patch Released by Anomaly
Anomaly, the company behind OpenCode, addressed the issue in version 1.18.33, released on September 28. However, the company did not request a CVE or publicly announce a security advisory, meaning that vulnerability scanners might not detect the issue in older versions, specifically from 1.0.137 to 1.18.32.
The vulnerability arises during the sign-in process, where the MCP server provides an OAuth “authorization endpoint” web address. OpenCode passes this address to a helper that opens it in a browser. Due to inadequate input escaping, malicious addresses containing PowerShell commands could execute these commands.
Steps to Mitigate the Issue
The vulnerability affects only Windows and WSL platforms, as OpenCode’s method of launching browsers on macOS and Linux does not involve shell processing. Pillar Security, which discovered the flaw, rated it as critical with a proposed severity score of 9.8 out of 10. The flaw was disclosed publicly on October 19.
To mitigate the risks, users should upgrade to OpenCode version 1.18.33 or later. If upgrading is not feasible, users should remove any unverified remote MCP servers from their configuration. Running the command opencode mcp list will reveal which servers are configured.
Historical Context and Future Implications
This is not the first instance of such a vulnerability in OpenCode. In July 2025, a similar issue was identified in the mcp-remote proxy, which was then assigned CVE-2025-6514. The browser helper package, “open,” used by OpenCode, was previously reported as a command-injection risk in 2023, prompting a fix in its version 11. However, OpenCode continued using an older version until recently.
Despite no evidence of active exploitation, the potential for abuse exists, highlighting the importance of maintaining updated software. This vulnerability is distinct from a separate breach involving OpenCode’s hosted Console, which may have exposed API keys for services like OpenAI, Anthropic, and Google.
In conclusion, developers using OpenCode are strongly advised to update their software and regularly verify their server configurations to safeguard against similar vulnerabilities in the future.
