OpenCode flaw let MCP servers run code during Windows sign-in
Pillar Security says a malicious MCP server could run code on Windows and WSL during OpenCode sign-in. Version 1.18.33 fixes it, and no attacks are reported.
Pillar Security has disclosed a flaw in OpenCode, an open source AI coding agent, that could let a remote MCP server run commands on a developer's computer. It affects OpenCode 1.0.137 through 1.18.32 on Windows and WSL. macOS and Linux are not affected. The fix shipped in version 1.18.33 on 28 September, and Pillar reports no signs of attacks in the wild.
During OAuth sign-in, the MCP server tells OpenCode which web address to open. On Windows, an older version of a helper package placed that address into a PowerShell command without escaping it, so a crafted address could run a command.
Why it matters
The server does not need to be malicious on the day you add it. Pillar notes that a trusted server could be compromised later, or its domain could expire and change hands. The attacker needs control of a remote MCP server that the developer has configured.
The sources differ on when the code can run. The Hacker News says the browser step happens only when a developer starts sign-in. Pillar describes the default automatic handshake as needing no extra user consent.
There is also no CVE for this issue, and Pillar says scanners and dependency alerts will not flag it without one. Pillar rates it critical with a proposed CVSS score of 9.8, which is the firm's own assessment.
OpenCode's maker, Anomaly, fixed the problem but did not publish an advisory, and the release notes did not mention security. Its security policy says user-configured MCP servers are "outside our trust boundary". According to Pillar, Anomaly said a malicious MCP server falls outside its threat model.
What you can do
- Run OpenCode on Windows or WSL? Upgrade to 1.18.33 or later.
- Check each machine by hand, since your usual tools may not raise an alert.
- Remove remote MCP servers you do not recognise or no longer use.
- If you cannot upgrade, Pillar advises removing any unvetted remote MCP servers from your configuration.
- Treat each MCP server as code you are choosing to trust, and check who runs it before adding it.
- If you build an MCP client, do not pass web addresses from a server to a shell. Pillar notes that checking for https alone would not have stopped this attack.
Sources
- Pillar Security: remote code execution in OpenCode via MCP OAuth
- The Hacker News: OpenCode flaw
- OpenCode v1.18.33 release
Source: Pillar Security