Pillar Security’s Eilon Cohen disclosed a remote code execution flaw in the OpenCode coding agent, which the researchers rate CVSS 9.8. It hits versions 1.0.137 through 1.18.32 on Windows and WSL.
Here’s how it works: a malicious remote MCP server could run code on a developer’s machine during the MCP OAuth sign-in. On Windows, the URL was handed to PowerShell without proper escaping, so an evil payload could hide inside a legit-looking HTTPS URL.
The part that bugs me is that, according to the researchers, Anomaly (the company behind OpenCode) said malicious MCP servers were “outside their threat model.” Then it fixed the bug in 1.18.33 on September 28 with no CVE and no advisory. That means dependency scanners won’t flag old installs. Pillar also says URL scheme validation alone doesn’t fully fix it.
Generic checklist
- If you run OpenCode on Windows or WSL, make sure you’re on 1.18.33 or newer.
- Only connect MCP servers you actually trust, and treat a new remote MCP server like installing new software.
- Don’t count on scanners to catch bugs that were fixed without a CVE. Check your agent tool versions yourself.
God Bless, and Needs Garlic!
