← All incidents

Pillar Security: a remote MCP server could run commands on Windows and WSL machines through OpenCode's OAuth sign-in (fixed in 1.18.33, no advisory)

Vulnerability · OpenCode · HIGH

Summary

Pillar Security reported on Oct 19, 2026 that OpenCode, the open-source AI coding agent made by Anomaly, could be made to run commands on a developer's Windows or WSL machine by a remote MCP server it connected to. When a remote MCP server asked for OAuth sign-in, OpenCode opened the authorization address supplied by that server in a browser, using the open npm package. On Windows, open 10.1.2, the version OpenCode pinned, built a PowerShell command without escaping the address, so an ordinary-looking https link containing $(...) ran as PowerShell code with the developer's privileges. Pillar says opencode-ai 1.0.137 through 1.18.32 are affected on Windows and WSL, and macOS and native Linux are not. Anomaly merged a fix on Sep 25, 2026 in pull request #51414, which is described as a refactor. It moves OpenCode to open 11.0.4, which quotes the address safely, and adds http and https checks. The fix shipped in OpenCode 1.18.33 on Sep 28, 2026, and Pillar calls it fast and thorough. Per Pillar, Anomaly said malicious MCP servers are outside its threat model and did not publish an advisory or request a CVE, so vulnerability scanners will not flag older versions. Pillar proposes a CVSS 3.1 score of 9.8; there is no official score. We found no reports of exploitation. This is unrelated to OpenCode's October 2026 Console breach.

Severity

Timeline

1. Oct 18, 2023
   An issue titled "OS command injection on windows when opening urls" is filed on the open package's GitHub repository (issue #323).
2. Nov 10, 2025
   The open package's maintainer commits "Fix PowerShell argument escaping" (274d704). It ships in open 11.0.0 on Nov 15, 2025.
3. Dec 9, 2025
   OpenCode 1.0.137, the first affected version per Pillar, is published to npm.
4. Aug 29, 2026
   Pillar reports the flaw to Anomaly through a private GitHub security advisory, per Pillar.
5. Sep 25, 2026
   Per Pillar, Anomaly confirms the report reached the team and says malicious MCP servers are outside its threat model. The same day, pull request #51414 is merged, bumping open from 10.1.2 to 11.0.4 and adding http and https checks.
6. Sep 28, 2026
   OpenCode 1.18.33 is released with the fix. Its release notes do not mention security.
7. Oct 19, 2026
   Pillar Security publishes its write-up.

How it happened

OpenCode can connect to remote MCP servers over HTTP. If such a server requires OAuth, the MCP client asks it where to sign in and receives an authorization_endpoint, then sends the user's browser there. In affected versions, OpenCode passed that server-supplied address straight to the open npm package. On macOS and Linux, open launches the browser with the address as a separate argument and no shell, so nothing runs. On Windows, and under WSL where it hands off to Windows, open 10.1.2 assembled a PowerShell Start command and wrapped the address in double quotes without escaping it, then ran it with powershell -EncodedCommand. PowerShell expands $(...) inside double-quoted strings, so an https address with a $(...) section ran that code as the developer. Pillar notes that checking the URL scheme is not enough on its own, because the payload is a valid https link. We checked the public code. OpenCode's v1.18.32 package pins open 10.1.2, and its MCP OAuth provider forwarded the authorization URL without checks. Pull request #51414, merged Sep 25, 2026 as commit 29f07e0c, routes every browser launch through a new helper that only opens http and https links, adds the same check in the MCP OAuth code, and moves to open 11.0.4. The open package fixed the escaping upstream in commit 274d704, released in open 11.0.0 in November 2025, and now wraps the target in single quotes, which PowerShell does not expand. Pillar compares the bug to CVE-2025-6514 in mcp-remote, which used the same OAuth field and the same kind of browser-opening code.

How to check your app

• Run opencode --version. On Windows or WSL, upgrade anything 1.18.32 or older to 1.18.33 or later (npm's latest was 1.19.3 on Oct 20, 2026). There is no advisory or CVE, so dependency scanners will not flag older versions for you.
• List the remote MCP servers in your OpenCode config (mcp entries with a url) and remove any you don't control or no longer use. Per Pillar, a server that is taken over later, or a domain that lapses, is enough.
• If you build an MCP client or any tool that opens links from outside input on Windows, check which version of the open package you ship. Pillar says open 10.x does not escape the target; open 11.0.0 and later do. Don't pass server-supplied OAuth addresses to a shell-backed opener without checks.
• If you used an affected version on Windows or WSL with a remote MCP server you don't fully trust, look for programs, scheduled tasks or startup entries you don't recognize, and consider rotating the credentials stored on that machine.

Related on VibeIncidents

• Any web page could make OpenCode's local server install and run an attacker's package (GHSA-632h)

Sources

• Pillar Security: Open and Shut: Remote code execution in opencode via MCP OAuth (Eilon Cohen, Oct 19, 2026)
• Pillar Security on X (Oct 19, 2026)
• OpenCode pull request #51414: share a browser opener across opencode and tui
• OpenCode commit 29f07e0c (the fix)
• OpenCode 1.18.33 release on GitHub
• open package commit 274d704: Fix PowerShell argument escaping
• open package issue #323: OS command injection on windows when opening urls
• npm: opencode-ai

Corrections and updates

None. Re-checked against every source on Oct 20, 2026.