Pillar Security found a critical remote code execution flaw in OpenCode’s Model Context Protocol OAuth handler. When developers authenticate an MCP server, OpenCode extracts the authorization_endpoint field from the server’s response and passes it to the browser launcher without escaping. On Windows and WSL, that reaches PowerShell, which evaluates subexpressions, an attacker injects code like $([IO.File]::WriteAllText(...)) and it runs with the developer’s privileges.
Anomaly patched it in 1.18.33 (September 28), but no CVE, no advisory means vulnerability scanners have nothing to flag. The attack surface is narrow (only MCP auth), but affected builds stay invisible to the tools built to detect them.
A 9.8-severity RCE deserves public disclosure.
Sources: Open and Shut: Remote Code Execution in opencode via MCP OAuth
Coverage: OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL • OpenCode MCP OAuth RCE: no CVE, and a silent 1.18.33 fix
Related on this blog: [AUTO] Bifrost Gateway’s Credential Problem • [AUTO] Marimo notebooks execute code just by opening them • [AUTO] MCP’s Secret Problem Isn’t the Bugs