OpenCode MCP Flaw Lets Malicious Servers Run Commands on Windows and WSL

If a vulnerable version of OpenCode connects to a malicious MCP server, the server can run commands on the developer’s machine. Pillar Security disclosed the issue on October 19. It affects Windows and WSL, and OpenCode 1.18.33 fixes it.

How the attack works

The flaw is in OAuth authentication when OpenCode connects to a remote MCP server. A server controlled by an attacker can supply a crafted URL that is passed to the mechanism that opens the browser. A vulnerable dependency handles that URL in a way that allows commands to be executed.

According to the researchers, the user does not need to approve anything else once the connection starts. This is not a case of tricking the AI model into following a malicious instruction. It is a bug in the software that handles the integration.

Who is affected

The researchers list OpenCode versions 1.0.137 through 1.18.32 on Windows and WSL as affected. They found that macOS and Linux installations are not exposed to this particular attack.

The patched release, 1.18.33, shipped on September 28. What is new is the public disclosure that the change fixed a security issue. No CVE number has been assigned, so automated vulnerability feeds alone may not flag it.

What to do now

• Check which OpenCode version runs on developer workstations, including inside WSL.
• Update vulnerable installations to version 1.18.33 or later.
• If you have to delay the update, remove unverified remote MCP servers from the configuration.
• Decide who is allowed to add integrations and which resources the tool can reach.
• If you suspect a malicious connection, preserve the logs and review the processes launched under the user’s account.

SecurHUB’s take

AI-powered developer tools should be part of your software inventory and access reviews. A security audit can also cover MCP integrations and what code and credentials these tools can reach.

Sources: Pillar Security, The Injection