As reported by The Hacker News, a critical command injection vulnerability in the OpenCode AI coding agent allowed malicious or compromised MCP (Model Context Protocol) servers to execute arbitrary PowerShell commands on a developer's Windows or WSL machine during the OAuth sign-in flow. Pillar Security, who discovered and privately disclosed the flaw on August 29, 2026, rated it CVSS 9.8 (Critical). Anomaly shipped a fix in version 1.18.33 on September 28 but declined to request a CVE or publish a security advisory, citing that user-configured MCP servers fall outside their threat model.

Security Impact: As reported by The Hacker News, a critical command injection vulnerability in the OpenCode AI coding agent allowed malicious or compromised MCP (Model Context Protocol) servers to execute arbitrary PowerShell commands on a developer's Windows or WSL machine during the OAuth sign-in flow.

This is not a novel attack pattern. The root cause — passing a server-controlled OAuth authorization endpoint string into a PowerShell command without proper escaping — is textbook command injection. The same class of bug surfaced in July 2025 in the mcp-remote proxy (CVE-2025-6514). That OpenCode's browser-launch helper repeated this mistake suggests the industry is still treating MCP integration plumbing as configuration rather than security-critical code.

Vulnerability Details

ProductOpenCode (by Anomaly)
Affected Versions1.0.137 through 1.18.32
Patched Version1.18.33 (released September 28, 2026)
SeverityCritical — CVSS 9.8 (proposed by Pillar Security)
CVE AssignedNo — Anomaly declined to request one
Affected PlatformsWindows and WSL only (macOS and Linux unaffected)
Active ExploitationNot reported in the wild at time of disclosure
TriggerRunning opencode mcp auth against a malicious/hijacked MCP server

Why the No-CVE Decision Matters

Anomaly's position — that user-configured MCP servers sit outside their trust boundary — is defensible in the abstract but breaks down in practice. The OAuth authorization endpoint is supplied by the remote server and consumed by OpenCode's local code. The responsibility for safely handling that input rests squarely on the application, regardless of where it originated. A compromised MCP server domain, a lapsed registration, or a supply-chain takeover can turn a previously trusted server into an attack vector without the developer ever changing their configuration.

By declining to assign a CVE, Anomaly has ensured that standard vulnerability scanners, dependency management tools, and security teams' alerting pipelines will never flag the vulnerable versions. Organizations relying on automated CVE-based patching are effectively blind to this risk.

Who Is Most Exposed

  • Development teams on Windows/WSL using OpenCode versions 1.0.137–1.18.32 with any MCP server configured
  • Organizations using third-party or community MCP servers where the server operator's infrastructure could be compromised
  • Teams with stale MCP server configurations pointing at domains that may have changed hands or lapsed
  • Enterprises with developer workstations holding source code, credentials, or cloud access keys — execution runs with the developer's own privileges

Shield53 Recommendations

  • Audit OpenCode installations immediately. Check every developer workstation for OpenCode versions in the 1.0.137–1.18.32 range. Without a CVE, automated scanners will not surface this — manual verification is required.
  • Upgrade to version 1.18.33 or later on all Windows and WSL environments. Treat this as a priority patch despite the absence of a formal advisory.
  • Inventory and restrict MCP server configurations. Audit which MCP servers your developers have configured. Remove any that are no longer actively needed, and verify the integrity of those that remain. Consider implementing an allowlist of approved MCP servers.
  • Monitor for suspicious PowerShell activity originating from OpenCode or its helper processes. Detecting unexpected child process spawns from development tools can catch this and similar injection vectors.
  • Review whether developer workstations should hold long-lived cloud credentials. If code execution with developer-level access is the threat, reducing the blast radius of compromised developer sessions limits the damage from this and future similar flaws.
  • Treat MCP server connections as untrusted input sources. Until MCP security maturity improves across the ecosystem, organizations should assume that any remote tool server could be compromised and design their developer security posture accordingly.