CybersecurityVulnerability Management

OpenCode Flaw Enables Code Execution via Malicious MCP Servers

Analyst 207||Source: TheHackerNews
Developer workstation with laptop code display on cluttered desk in office setting.

Pillar Security rated the flaw critical, with a proposed severity score of 9.8 out of 10.

Pillar Security's finding and timeline

Pillar Security privately reported a code‑execution flaw in OpenCode's MCP sign‑in flow on August 29 and publicly disclosed it on October 19. The company characterized the issue as critical and suggested a severity of 9.8/10. Anomaly, the company that develops OpenCode, released a fix in version 1.18.33 on September 28 but did not request a CVE or publish a dedicated security advisory for the problem.

How the MCP sign‑in flow could run PowerShell

OpenCode connects to external MCP (Model Context Protocol) servers to add outside tools. During an MCP sign‑in — when a developer runs opencode mcp auth or issues an equivalent request — the remote MCP server supplies an OAuth "authorization endpoint" URL that OpenCode hands to a browser‑launch helper on the local machine. On Windows and the Windows Subsystem for Linux (WSL), OpenCode wrapped that address in a PowerShell command without escaping shell metacharacters. That meant an authorization endpoint crafted to carry PowerShell syntax could cause the helper to execute arbitrary PowerShell on the developer's machine with the developer's access rights.

Affected platforms: Windows and WSL

The flaw affects OpenCode when run on Windows and on WSL. macOS and Linux are not affected because, on those platforms, OpenCode opens the browser without passing the address through a shell. The browser step is triggered only during an explicit sign‑in operation; merely configuring an MCP server or opening a session does not reach the vulnerable path.

Why vulnerability scanners and dependency alerts won't warn you

Because Anomaly did not request a CVE or publish a security advisory for this flaw, automated vulnerability scanners and many dependency‑alert systems will not flag affected OpenCode builds. Pillar highlighted that the at‑risk versions are 1.0.137 through 1.18.32; upgrading to 1.18.33 or later removes the vulnerability. The upstream code change was shipped as a routine refactor of the browser‑launch code, and neither the pull request nor the release notes mentioned a security flaw.

What this means for developers, security teams, and procurement

  • Developers: If you use OpenCode on Windows or WSL, an MCP server you have added — even one that was benign when configured — could become a source of remote code execution if the server is hijacked or its domain changes hands. Pillar reported no signs of active exploitation and published no indicators of compromise.
  • Security teams: Asset and configuration checks must look beyond scanner output. Because the flaw has no CVE and no advisory from the vendor, teams will need to query OpenCode versions directly and use opencode mcp list to enumerate configured MCP servers.
  • Procurement leaders: The incident underscores that Anomaly's security posture treats configured MCP servers as "outside our trust boundary," per the company's security policy; that policy position influenced Anomaly's response when asked to request a CVE, according to Pillar.

What to do now — upgrade, inspect servers, and short mitigations

Pillar and the OpenCode project publish a short, concrete set of actions:

  • Upgrade to OpenCode 1.18.33 or later. The fix was included in that release on September 28.
  • If you cannot upgrade immediately, remove any remote MCP servers you have not vetted from your OpenCode configuration.
  • Run opencode mcp list to see which MCP servers are currently configured in your environment.

Additional context in the record: OpenCode previously shipped advisories for other code‑execution flaws this year, including a fix in August, and a closely similar command‑injection bug affected the mcp‑remote proxy in July 2025 (assigned CVE‑2025‑6514). The widely used browser helper package named open had a Windows command‑injection risk reported in 2023 and was fixed in version 11, but OpenCode remained on an older release of that helper before this fix. Also separate from this flaw is a disclosed breach of OpenCode's hosted Console around the same time, which may have exposed some users' stored API keys for OpenAI, Anthropic, and Google.

That list of specifics points to two durable facts: the vulnerable action is precise and reproducible (an explicit MCP sign‑in on Windows/WSL), and discovery and mitigation will depend on administrators and developers updating versions and auditing configured MCP servers rather than relying on automated scanner alerts.

Source: The Hacker News

Code ExecutionEmerging ThreatsPowershellSupply ChainVulnerability ManagementModel Context ProtocolCritical VulnerabilityOpencode FlawMalicious MCP Servers
Related Intelligence

Continue Reading

Empty pharmacy store interior with a network device on a table.

Cisco Firewall Breach Exposes Lax Security at Major Pharmacy Chain

A security audit of a major US pharmacy retailer uncovered a shocking lapse in security: a Cisco edge firewall with an administrator password that was simply "password". This alarming oversight was discovered by Dahvid Schloss, a penetration-testing specialist, during a routine review of the company's network configurations.

Analyst 207
Technician troubleshoots server equipment in a network operations center.

HTTP/3 Servers Vulnerable to Crashing via QPACK Flaws

A single malicious connection can crash many HTTP/3 servers due to flaws in QPACK header compression, which allows attackers to send a small batch of compressed headers that expand into a much larger set, overwhelming the server's memory. This vulnerability can be exploited with a relatively simple attack, and experts warn that the impact could be significant.

Analyst 207
Cluttered modern office desk with laptop, notes, and coffee cups near a sunny window.

Node.js Discloses Brotli Decoder Flaw Allowing Remote Code Execution

A critical flaw in Node.js's Brotli decoder could let hackers execute remote code - but fortunately, a patch has been released to fix this vulnerability. The update tackles an out-of-bounds write issue that occurs when decompressing maliciously crafted Brotli data.

Analyst 207
Modern data center with rows of servers and IT professionals in the background discussing in front of a large screen.

SANS Warns of Cloud Security Maturity Gap

The alarming truth is that while nearly every organization has made the cloud transition, most are still struggling to keep up with security - a whopping 93% of organizations now run production workloads in the cloud, yet only 40% have an advanced or optimized cloud security strategy in place. Misconfiguration, a preventable threat, is a gaping hole sitting in many accounts, waiting to be exploited.

Analyst 207