OpenCode patched a critical RCE bug without filing a CVE
Pillar Security found a flaw letting a malicious MCP server run commands on a Windows machine during OAuth login. Anomaly fixed it quietly three weeks before anyone said so.
Security researchers at Pillar Security disclosed a critical remote code execution bug in OpenCode, the open-source AI coding agent, on 19 October. A malicious MCP server can abuse the OAuth login flow to run arbitrary commands on a developer’s machine, with no extra clicks needed.
The bug sits in how OpenCode handles the authorization_endpoint an MCP server returns during OAuth discovery. On Windows, that URL is passed unescaped into a PowerShell command, and PowerShell expands $(...) inside double-quoted strings, even inside an ordinary https:// link. It affects opencode-ai versions 1.0.137 through 1.18.32, on Windows and WSL only; macOS and Linux were never exposed. Pillar reported it privately on 29 August, and Anomaly shipped a fix in version 1.18.33 on 28 September, three weeks before Pillar’s public writeup. No CVE or security advisory was ever filed for it.
npm ls opencode-ai
# update if you're below 1.18.33Why it matters: OpenCode has more than 218,000 stars on GitHub, and with no CVE to key off, dependency scanners and vulnerability alerts won’t flag anyone still on an affected version. If you run OpenCode on Windows or WSL and point it at any MCP server you don’t fully control, check your version now rather than waiting for a scanner to tell you.
The caveat: the CVSS 9.8 rating is Pillar’s own assessment, not an official score, since no CVE was ever assigned to validate it against.