An attacker-controlled Model Context Protocol (MCP) server could execute arbitrary code on Windows and Windows Subsystem for Linux (WSL) systems running vulnerable versions of Anomaly’s OpenCode AI coding agent, security researchers have disclosed. The flaw was fixed in OpenCode 1.18.33, released Sept. 28, but the developer did not publish a security advisory or obtain a CVE, according to research from Pillar Security.
The vulnerability affects OpenCode versions 1.0.137 through 1.18.32 when remote MCP servers are configured. During OAuth discovery, the remote server controls the authorization_endpoint value that OpenCode uses to launch a browser. On Windows, the affected implementation passed that URL into PowerShell without correctly escaping it, allowing command-substitution syntax embedded in an otherwise ordinary URL to run with the developer’s privileges.
Pillar rated the issue critical, proposing a CVSS 3.1 score of 9.8 based on network exploitability, low attack complexity and the potential for complete impact to confidentiality, integrity and availability. The OAuth flow launched the authorization URL automatically, meaning exploitation did not require prompt injection, an AI-model compromise or an additional approval from the user. A server did not necessarily need to be malicious when first configured: a later compromise, hijacked service or abandoned domain could potentially deliver the payload when the connection was used.
The fix updated OpenCode’s open dependency to version 11.0.4 and added checks restricting authorization URLs to HTTP and HTTPS schemes. Pillar said the dependency update was the key change because newer PowerShell argument handling prevents command expansion inside the URL; the scheme checks provide additional protection. The researchers documented proof-of-concept payloads, but reported no confirmed exploitation of this specific OpenCode flaw in the wild, no CISA Known Exploited Vulnerabilities listing and no public CVE or NVD entry.
Developers and security teams should inventory OpenCode installations on Windows and WSL and upgrade to version 1.18.33 or later immediately. Because the issue has no CVE, vulnerability scanners and dependency alerts may not identify affected installations automatically. Organizations should also review configured MCP servers and remove untrusted or unnecessary endpoints, treating remote MCP infrastructure as code-execution-sensitive rather than as a passive authentication dependency.
