OpenCode on Windows and WSL (Pillar Security, 19 Oct): an attacker-controlled remote MCP server could run code on a developer's machine during MCP OAuth sign-in — fixed in 1.18.33 (28 Sep) without a CVE or security advisory, Pillar says

Pillar Security said on 19 October 2026 that it found a critical remote code execution flaw in opencode, Anomaly's open-source AI coding agent, affecting Windows and Windows Subsystem for Linux (WSL): an attacker-controlled remote Model Context Protocol (MCP) server can execute arbitrary code on a developer's machine during a remote MCP OAuth authentication process, without additional user interaction or consent. Pillar says the MCP server supplies the OAuth authorization_endpoint, which opencode passed to the open package (open@10.1.2); on Windows that package builds a PowerShell command without escaping the target, so a PowerShell subexpression carried inside an ordinary https:// URL runs. Pillar says the server did not need to be malicious when configured: a later compromise, hijacked registry entry, typosquat or expired domain could trigger the same path. According to The Hacker News (22 Oct), the browser step runs only when a developer starts the sign-in, for example by running opencode mcp auth. Pillar lists opencode (opencode-ai on npm) versions 1.0.137 to 1.18.32 on Windows and WSL as affected and says macOS and Linux are not affected; it says the fix shipped in 1.18.33, which GitHub shows was released on 28 September 2026. Pillar says the fix (pull request #51414, merged 25 September) bumped open to 11.0.4 and added http/https scheme checks, but that scheme validation alone would not have stopped its payload and the dependency bump is what closed the hole. Pillar says Anomaly did not issue a security advisory or request a CVE, shipped the fix as a refactor, and told Pillar that malicious MCP servers are outside its threat model; opencode's GitHub security policy says external MCP servers a user configures are outside its trust boundary. Pillar rates the flaw critical with a proposed CVSS 3.1 score of 9.8, and notes that without a CVE, vulnerability scanners and dependency alerts will not flag affected installs. Primary: Pillar Security (19 Oct); vendor: opencode v1.18.33 release on GitHub; wire: The Hacker News (22 Oct).

Product

Anomaly opencode AI coding agent (opencode-ai on npm) — remote MCP OAuth sign-in on Windows and WSL

Versions

Affected (Pillar): 1.0.137 to 1.18.32 on Windows and WSL; macOS and Linux not affected. Fixed: 1.18.33 (released 28 Sep 2026). No CVE or vendor advisory as of 22 Oct.

CVSS

9.8 Critical (CVSS 3.1, proposed by Pillar Security; no CVE assigned)

Exploited in Australia?

unknown

Patch to

Upgrade opencode to 1.18.33 or later on Windows and WSL, and check installed versions directly, because no CVE exists for scanners to match. Until you can upgrade, Pillar advises removing unvetted remote MCP servers from your opencode configuration; The Hacker News notes opencode mcp list shows which servers are configured.

Primary: Pillar Security — Open and Shut: Remote Code Execution in opencode via MCP OAuth (19 Oct 2026) · Vendor: anomalyco/opencode — Release v1.18.33 on GitHub (28 Sep 2026) · The Hacker News — OpenCode flaw lets malicious MCP servers execute code during sign-in on Windows and WSL (22 Oct 2026)

tech ai