"The breach hit a legacy system behind a hosted key proxy, and exposed provider keys users had stored there," Eilon Cohen of Pillar Security said — a short, precise account that underscores why two recent security incidents involving OpenCode demand attention from developers and security teams.
What Pillar Security disclosed on October 19
On October 19, Pillar Security published a report by Eilon Cohen, head of security research, describing a critical remote code execution (RCE) vulnerability in the open-source AI coding platform OpenCode. Pillar traced the flaw to OpenCode versions 1.0.137 through 1.18.32 and assessed the issue at a critical severity of 9.8 (CVSS), saying a compromised remote model context protocol (MCP) server could execute arbitrary code on a developer’s machine during an MCP OAuth authentication process without additional user interaction or consent.
Pillar Security reported the issue privately via a GitHub Security Advisory with full reproduction material at the end of August 2026; the public report and technical assessment were published in mid-October.
How the RCE works on Windows and WSL, according to the researchers
Pillar’s technical findings focus on how an MCP-controlled OAuth handshake could carry a malicious payload inside a seemingly legitimate URL. On Windows — and in Windows Subsystem for Linux (WSL) environments — an open dependency used by OpenCode passed an unescaped URL to PowerShell. Because the URL was not correctly quoted, PowerShell could interpret part of the URL as a command, enabling remote code execution.
Researchers warned that URL scheme validation alone is insufficient: a malicious payload can be embedded in an HTTPS URL so scheme checks do not block it. The team recommended avoiding passing untrusted URLs through shell commands and instead using argument-based process execution to reduce risk.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildAnomaly's reaction and the quiet September patch
Pillar Security said it notified Anomaly, the company behind OpenCode, at the end of August. A month later, Anomaly acknowledged receipt but told Pillar that malicious MCP servers were “outside their threat model.”
On September 28, Anomaly released OpenCode version 1.18.33. Pillar Security reports that the release added URL scheme checks but did not include a CVE identifier or a public security advisory. Pillar contends the essential remediation was not the scheme check but updating the dependency to a version that correctly quotes the URL so PowerShell cannot interpret the payload as executable code.
Pillar warned that because no CVE or advisory accompanied the change, conventional vulnerability scanners and dependency alerting systems will not reliably identify affected installations, “potentially leaving enterprises unaware that they need to upgrade.”
How this differs from the Console breach announced days earlier
Pillar and Anomaly had also reported a separate Console breach a few days before the RCE disclosure. The Console is OpenCode’s facility for teams to share access to AI models through centrally managed API credentials. Cohen said the Console incident “hit a legacy system behind a hosted key proxy, and exposed provider keys users had stored there.”
Cohen drew a technical distinction: the Console breach exposed stored provider keys via a legacy hosted key proxy, while the RCE vulnerability permits a malicious remote MCP server to execute code on a developer’s endpoint during an OAuth handshake. “Different target and attacker position,” he said, but both incidents, Cohen added, reduce to a common vector: who is entrusted with credentials and inputs, and what the tool does with them.
What this means for developers, enterprises, and security teams
- Developers and end users: If you run OpenCode on Windows or WSL, Pillar’s advisory indicates affected versions are 1.0.137 through 1.18.32; the vendor pushed 1.18.33 on September 28. Researchers argue that merely installing 1.18.33 may not be sufficient unless the underlying dependency that quotes URLs is also updated.
- Enterprises and procurement leaders: Because Anomaly did not publish a CVE or security advisory alongside the September patch, automated scanning and dependency-alert tooling may not flag vulnerable installations. Pillar warned this gap could leave organizations unaware they need to upgrade.
- Security teams and devops: Pillar’s technical recommendation is to avoid passing untrusted URLs through shell commands and to prefer argument-based process execution. In this case, the critical remediation was changing a dependency to correctly quote URLs so PowerShell cannot interpret them as commands.
The two incidents — the Console breach and the RCE vulnerability — offer a paired caution: credentials stored in a hosted proxy can be exposed, and untrusted remote servers can attempt to execute code during protocol handshakes. Pillar Security’s public disclosure and the timeline of private notification, vendor acknowledgement, and a quiet patch underscore a practical problem: without clear advisories and CVEs, even high-severity flaws can remain invisible to the automated detection systems many organizations rely on.
For now, the record in Pillar’s report and Anomaly’s actions is straightforward: the vulnerability affects specific OpenCode versions, was privately reported at the end of August 2026, and was patched in 1.18.33 on September 28 without a CVE or public advisory. Pillar’s judgment — that URL quoting in the dependency is the critical fix and that scheme checks alone are insufficient — leaves one concrete operational question for organizations using OpenCode: have you confirmed both your OpenCode version and the quoted-URL dependency are up to date?
