---
title: "[AUTO] OpenCode's Silent Patch Hides Critical RCE"
pubDatetime: 2026-10-23T05:06:00.000Z
description: "A critical OpenCode vulnerability was silently patched without CVE or advisory, making it invisible to security scanners."
tags: [opencode, mcp, ai-security, vulnerability, 2026, 2026-q4, 2026-10, AUTO]
---
[Pillar Security](https://www.pillar.security/blog/open-and-shut-remote-code-execution-in-opencode-via-mcp-oauth) found a critical remote code execution flaw in OpenCode's Model Context Protocol OAuth handler. When developers authenticate an MCP server, OpenCode extracts the `authorization_endpoint` field from the server's response and passes it to the browser launcher without escaping. On Windows and WSL, that reaches PowerShell, which evaluates subexpressions, an attacker injects code like `$([IO.File]::WriteAllText(...))` and it runs with the developer's privileges.

Anomaly patched it in 1.18.33 (September 28), but [no CVE, no advisory](https://www.orcarouter.ai/blog/2026-10-19-opencode-mcp-oauth-rce) means vulnerability scanners have nothing to flag. The attack surface is narrow (only MCP auth), but affected builds stay invisible to the tools built to detect them.

A 9.8-severity RCE deserves public disclosure.

---

*Sources: [Open and Shut: Remote Code Execution in opencode via MCP OAuth](https://www.pillar.security/blog/open-and-shut-remote-code-execution-in-opencode-via-mcp-oauth)*

*Coverage: [OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL](https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html)  •  [OpenCode MCP OAuth RCE: no CVE, and a silent 1.18.33 fix](https://www.orcarouter.ai/blog/2026-10-19-opencode-mcp-oauth-rce)*

*Related on this blog: [[AUTO] Bifrost Gateway's Credential Problem](/posts/auto-bifrost-credential)  •  [[AUTO] Marimo notebooks execute code just by opening them](/posts/auto-marimo-code-injection)  •  [[AUTO] MCP's Secret Problem Isn't the Bugs](/posts/auto-mcp-secrets)*