A critical remote code execution vulnerability in the OpenCode AI coding tool was quietly patched after researchers revealed that users running certain versions could be exploited during the MCP OAuth authentication process. The flaw affected OpenCode versions 1.0.137 through 1.18.32 on Windows and Windows Subsystem for Linux (WSL). If exploited via an attacker-controlled remote MCP server, arbitrary code could run on a developer’s machine without additional user interaction or consent.
Pillar Security disclosed the issue on 19 October 2026, privately sharing reproduction material through a GitHub Security Advisory, with Anomaly (the OpenCode vendor) confirming receipt a month later. The vendor recently pushed a fix to 1.18.33, but did not issue a CVE or public advisory alongside the patch.
Pillar Security researchers argue that the standard fix is insufficient because URL scheme validation alone does not prevent the attack: a malicious payload can be embedded in a seemingly legitimate HTTPS URL. On Windows, the vulnerable dependency passed the URL to PowerShell without proper escaping, allowing part of the URL to be interpreted as a command.
The recommended remediation is to update the dependency to a version that properly quotes the URL to stop PowerShell from treating the payload as executable code, and to avoid passing untrusted URLs through shell commands in favour of argument-based process execution. The researchers assess this as a critical issue (CVSS 9.8) and note that the OpenCode breach affecting its Console platform is unrelated, despite both incidents underscoring risks around handling credentials and inputs to AI tools.