cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

OpenCode Fixed Windows and WSL Flaw That Let Malicious MCP Servers Run Code During Sign-In

· Original article ↗

Summary

A flaw let a malicious or hijacked MCP server run PowerShell commands when OpenCode users signed in on Windows or WSL. Anomaly fixed it in version 1.18.33; Pillar Security reported no signs of exploitation.

Key points

  • Affected versions are OpenCode 1.0.137 through 1.18.32 on Windows and WSL; macOS and Linux are not affected.
  • The issue was triggered when a user initiated MCP sign-in, not merely by configuring a server or opening a session.
  • A server-controlled OAuth authorization address was passed into a PowerShell command without escaping, enabling command execution with the developer’s access.
  • An attacker would need control of an MCP server the developer had added; a server could also be compromised after being added.
  • Anomaly fixed the flaw in version 1.18.33. Pillar Security rated it critical, proposing a severity score of 9.8 out of 10.
  • No CVE or security advisory was issued, so scanners and dependency alerts will not flag affected builds; users should check their OpenCode version and upgrade.
  • Pillar reported no evidence of exploitation and published no indicators for checking for past attacks.

Article Details

Vulnerability Types
  • PowerShell command injection
Severity
Critical; Pillar Security proposed a score of 9.8/10.
Affected Versions
  • OpenCode 1.0.137 through 1.18.32
Exploitation Status
not_reported
Exploit Availability
unknown
Patch Status
available

MITRE ATT&CK

T1059.001 · PowerShellOn Windows and WSL, the browser helper placed the MCP server-supplied authorization endpoint into a PowerShell command without escaping it, allowing an attacker-crafted address to execute commands.

CVE

CVE-2025-6514The same kind of flaw has surfaced before. In July 2025, the mcp-remote proxy carried an almost identical bug, in which a malicious server's authorization endpoint reached the command line. It was assigned CVE-2025-6514.

Vendors

AnomalyAnomaly, the company behind OpenCode, fixed the flaw in version 1.18.33 on September 28. It did not request a CVE or publish a security advisory, so vulnerability scanners will not flag the builds still at risk: 1.0.137

Products

OpenCodeA flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer's Windows or WSL machine when the developer signed in. OpenCode connects to MCP (Model Context Protocol)Windows Subsystem for LinuxThe flaw affects OpenCode on Windows and the Windows Subsystem for Linux (WSL). macOS and Linux are not affected, because OpenCode opens the browser there without passing the address through a shell.

Related Articles