OpenCode Flaw Put Windows and WSL Users at Risk

A security flaw in the OpenCode AI coding agent could let a malicious or compromised MCP server run commands on a Windows computer when its user signed in. The problem is fixed, but people using OpenCode on a personal PC or small-office workstation need to check their version because ordinary vulnerability scanners may not warn them.

What happened

OpenCode can connect to Model Context Protocol, or MCP, servers that add outside tools. During an MCP sign-in, the server provides the web address that OpenCode opens for authorization.

On Windows and Windows Subsystem for Linux, OpenCode passed that address through a browser-opening helper that constructed a PowerShell command without properly escaping it. A server-controlled address could therefore include a command that Windows would execute with the OpenCode user’s access, according to The Hacker News.

The vulnerable path was reached only when a user started an MCP sign-in, such as by running opencode mcp auth or making the corresponding request. Merely configuring a server or opening an OpenCode session did not trigger the flaw. An attacker would also need control of an MCP server the user had added, although a previously legitimate server could become dangerous if it were later hijacked or its domain changed owners.

Anomaly, the company behind OpenCode, fixed the issue in version 1.18.33 on September 28. The affected releases are 1.0.137 through 1.18.32. The company did not publish a security advisory or request a CVE, so automated security and dependency tools may not identify vulnerable installations.

Who is affected

The flaw affects people running the listed OpenCode versions on Windows or WSL. OpenCode installations on macOS and Linux are not affected because those systems open the authorization page without passing its address through a shell.

Pillar Security, which reported the flaw, found no evidence that attackers had exploited it. It also did not publish indicators that users could search for to determine whether an attack had occurred.

What to do now

1. Open the terminal or PowerShell window where you use OpenCode and check the installed version. If it is between 1.0.137 and 1.18.32, treat it as vulnerable.

2. Upgrade OpenCode to version 1.18.33 or later using the same package manager or installation method you originally used. Confirm the installed version after the update finishes.

3. In your OpenCode setup, review every connected MCP server. Remove servers you do not recognize, no longer need, or cannot verify as being under the expected operator’s control.

4. Until OpenCode is updated, do not begin an MCP authentication flow on an affected Windows or WSL system. Having a server configured is not enough to trigger the flaw; the risk appears during sign-in.

5. If you completed an MCP sign-in through an untrusted or compromised server while using an affected release, run a full scan with current security software. The source provides no published indicators for checking past exploitation.

6. Keep MCP connections limited to services you actively use. A trusted server can still become risky later if it is taken over or its domain changes hands.