OpenCode fixes Windows and WSL MCP sign-in code execution flaw
Anomaly has fixed a critical code-execution flaw in its OpenCode AI coding agent that could allow a malicious or hijacked Model Context Protocol (MCP) server to run commands on a developer's Windows or Windows Subsystem for Linux (WSL) machine during sign-in. The fix arrived in OpenCode version 1.18.33 on September 28.
Pillar Security, which privately reported the issue on August 29 and disclosed it on October 19, assigned the bug a proposed critical severity score of 9.8 out of 10. Versions 1.0.137 through 1.18.32 are affected. Pillar said it found no evidence that the weakness had been exploited.
Server-controlled sign-in address reached PowerShell
OpenCode connects to MCP servers to provide external tools. When a developer initiates authentication with opencode mcp auth or makes the matching request, the MCP server provides the OAuth authorization endpoint that OpenCode should open in a browser.
On Windows and WSL, OpenCode sent that address to a browser-launch helper that constructed a PowerShell command without properly escaping the supplied value. An authorization URL crafted to include a PowerShell command could therefore execute that command with the developer's own permissions.
The vulnerable path is reached only when a developer starts the sign-in operation. Simply configuring an MCP server or opening an OpenCode session does not trigger it. However, an attacker could control a remote server that was malicious from the outset, later compromised, or hosted on a domain that subsequently changed hands.
Why version checks matter
macOS and Linux are not affected because OpenCode opens the browser on those platforms without routing the address through a shell. The Windows and WSL implementation relied on the widely used open package; its Windows command-injection risk was reported in 2023 and addressed in version 11, while OpenCode remained on an older release.
OpenCode also added an HTTP or HTTPS validation check, but that restriction does not stop this technique because the malicious authorization endpoint can use an ordinary HTTPS address. Updating the browser-launch dependency is what closed the injection route.
Anomaly released the change as a routine browser-launch refactor. It did not request a CVE or publish a security advisory, and its policy treats MCP servers configured by users as outside its trust boundary. The absence of a CVE means vulnerability scanners and dependency alerts are unlikely to flag affected OpenCode installations.
Actions for OpenCode users
Organizations using OpenCode on Windows or WSL should check the installed version directly and upgrade to 1.18.33 or later. They should also run opencode mcp list to review configured servers and remove remote MCP servers that have not been vetted. Until an upgrade is possible, limiting configurations to trusted servers reduces exposure during the sign-in workflow.
The issue is separate from the hosted OpenCode Console breach disclosed around the same time, which may have exposed stored API keys for OpenAI, Anthropic, and Google. For businesses, the immediate implication is to treat MCP server configuration and OAuth sign-in flows as operational security controls, not merely developer convenience settings.